Statement on HW / SW TPM

[lukehinds]

I think we could be a little less forceful in this view

Keylime can be used with a hardware TPM, or a software TPM emulator for development, testing, or demonstration purposes. However, DO NOT USE keylime in production with a TPM emulator! A software TPM emulator does not provide a hardware root of trust and dramatically lowers the security benefits of using keylime.

A swtpm for sure does not provide the same level of guarantees as a HW tpm, however its still superior to something like AIDE. Someone could use a cloud providers swtpm (google cloud provide them). Granted, they are trusting the providers host then, but it could be argued as a step up from solely trusting the target node you're measuring. The host could still attack your target node, but it could also provide insight into another entity compromising the system (for example an attack within the target nodes userland like (reverse shell etc)).

I recommend we remove the 'DO NOT USE' and instead explain the situation in that the are different levels of guarantee:

1. HW, you trust the chip
2. SWTPM, you trust the underlying host
3. SWTPM spawned soley in the node, you're trusting the same node as which you're measuring

3 is poorly worded , I agree and I am sure could be improved.

[lukehinds]

tagging tpm folks @stefanberger @puiterwijk

[stefanberger]

Yes, for software TPM you have to trust the underlying host and admin(s): https://github.com/stefanberger/swtpm/wiki#securitytrust-model-of-the-software-tpm

[mpeters]

I agree with the spirit of this change. "DO NOT USE" is too harsh. It's just different tradeoffs as it does provide protection against a lot of intrusion attacks, just not a malicious hypervisor.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed after 7 days if no further activity occurs. Thank you for your contributions.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed after 7 days if no further activity occurs. Thank you for your contributions.