44f61dc30d
enrollment/ and lock/ are moved to chrome/browser/ash/login/. This CL is part of the Chrome OS source code directory migration: https://docs.google.com/document/d/1g-98HpzA8XcoGBWUv1gQNr4rbnD5yfvbtYZyPDDbkaE. Bug: 1164001 Change-Id: I1ef24e379b81944516ec4144d82310af149b2b00 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2712893 Commit-Queue: Henrique Ferreiro <hferreiro@igalia.com> Reviewed-by: Hidehiko Abe <hidehiko@chromium.org> Owners-Override: Hidehiko Abe <hidehiko@chromium.org> Cr-Commit-Position: refs/heads/master@{#857423}
2.2 KiB
2.2 KiB
TPM Quick ref
TODO: this page looks very outdated. glossary.md does not exist, git.chromium.org does not exist. Delete it?
This page is meant to help keep track of TPM use across the system. It may not be up to date at any given point, but it's a wiki so you know what to do.
Details
- TPM ownership management
- TPM_Clear is done (as in vboot_reference) but in the firmware code itself on switch between dev and verified modes and in recovery. (TODO: link code)
- TPM owner password clearing (triggered at sign-in by chrome):
- PCR extend (no active use elsewhere):
- NVRAM use for OS rollback attack protection
- Tamper evident storage
- Tamper-evident storage for avoiding runtime device management mode changes
- User key/passphrase and cached data protection
- A TPM in a Chrome device has an EK certificate that is signed by an intermediate certificate authority that is dedicated to the specific TPMs allocated for use in Chrome devices. OS-level self-validation of the platform TPM should be viable with this or chaining any other trust expectations.
- TPM is used for per-user certificate storage (NSS+PKCS#11) using opencryptoki but soon to be replaced by chaps. Update links here when chaps stabilizes (Each user's pkcs#11 key store is kept in their homedir to ensure it is tied to the local user account). This functionality includes VPN and 802.1x-related keypairs.