Join the discussion
Write your take first — we'll ask for email only when you're ready to publish.
- Hacker News
- Attestation of any type: A double edged sword, where you are guaranteed to lose freedom. Attestation entrenches, empowers, and enriches other entities that aren't you.
Ironic how this post got upvoted in parallel to polar opposite in the #1 slot: "John Deere owners will get the right to repair equipment under FTC settlement" https://news.ycombinator.com/item?id=48838876
Engineers may debate about what-about-isms of vulnerabilities and counterexamples of TPM failures, but that misses the point: We should be debating about where society will be when devices you paid for serve other masters.
Probably we should just write/vibe/demand better software. Otherwise we're going to end up with a law demanding TPMs that watch more than just your firmware...
by davidfiala - You don't understand the use case or audience of this article:
> If your infra consistently enforces mTLS
This is for mutual authentication in corporate infrastructure. Attestation is a critical security property for these environments.
by solenoid0937 - Something worth calling out is that, as far as I've seen, most server TPM implementations are not great against physical access attacks. If servers might be physically compromised (eg. you are leaving a server unsupervised in a colo) shenanigans are still possible.
The TPMs are on separate chips from the main processor. If something were to man-in-the-middle the communications with the TPM, the hash digests can be "corrected" so the TPM thinks the boot artifacts were in the intended state. At least the ones I've worked with were SPI, but I've seen I2C ones as well. Either way, these are low speed, easy to mess with buses.
Also you want to pay real close attention to how you onboard new devices. The article states
> The EK comes with a x509 cert signed by the manufacture’s PKI. So the EK proves the TPM is legit.
This lets you know the TPM you are performing remote attestation of is made by a particular manufacturer, but an attacker can go buy a TPM chip from the right manufacturer off digikey, and feed it the intended hashes in pcr extend commands. For the attacks the TPM is supposed to prevent, you have to assume they could re-direct the tpm requests your remote validation service is trying to run to their own device by compromising the boot artifacts. You still have to figure out how to make sure your workflows are onboarding the TPM from _your_ hardware, not just a TPM from the same manufacturer.
by whiatp - There's support for encrypted communication with TPMs, but if I remember correctly this is almost never enabled by default.by mapkkk
- Have the CPU and the security chip derive their private keys from physical unclonable functions (to prevent extraction), let them exchange public keys once during manufacture, and from that point onward encrypt the SPI bus.
This is what some smartphones seem to do. I don't know if server motherboards do it but it would help a lot against this kind of attack.
by Dibby053 - I recall an event some years ago around Supermicro that was along these lines. Chips added during manufacturing by nation state that interfered with the operation of the BMC and TPM. Wasn't it the catalyst that pushed hardware supply chain concerns in to mainstream media?by simonjgreen
- Don't most (all?) modern CPUs have an embedded TPM? Plug-in TPMs were indeed a thing early on, but I thought that was a thing of the past by now. You can't exactly get in between the CPU and another part of the same CPU.
Also, isn't the EK (and therefore its cert) unique per-device, allowing you to tell it apart? The fact that the manufacturer used the same upstream key to sign both certs doesn't matter, just like a CA can sign multiple TLS certs with one root key.
by crote - > open explainer article
> Uses a lot of acronyms without even saying what they stand for let alone an explanation
> Article entirely unhelpful
Many such cases
- I didn't even finish the article because this sort of thing pisses me off too much.by pickleglitch
- I don't understand how this stuff prevents me from MITM:ing the attestation and routing requests to another device that is clean and attested? I.e. how do you know that the remote TPM belongs to the device you're talking to?
- Same way drm works, it’s going to be in layer of hw/sw that you don’t have control over. We don’t have commonly have control on the cpu, chipset, uefi. And on the top side things like widevine on the application layerby getcrunk
- The TPM is tamper proof hardware that includes privileged crypto keys that are installed (generated) by the device manufacturer with their identity retained / cataloged. The asymmetry of these privileged keys are where the private/control concerns end up coming from. If these top-level keys were instead unknown to everybody except the device owner (including an enterprise), then there would be no way for a random third party attacker to know whether it was talking to a hardware RPM or a software emulation of one.by mindslight
- Waiting for when one can't boot Windows without running snitch software which analyzes everything you do first to ensure you aren't a pedophile then that you aren't a terrorist then that aren't disloyal or un-American.
You won't be able to send email or bank if you aren't running the snitch or any configuration where you could defeat it.
Hell in a boring dystopia run by adults this could theoretically be a good thing! Never miss the next obvious school shooter!
Then look at who actually runs our country.
by michaelmrose - This is an incredibly nice technology that absolutely will be used to prevent you from using your computer as you wish.by egorfine
- this stuff should only be used for military and other high risk environments. it's an anti-consumer, anti-reuse, e-waste generating nightmare.
- This is also the technology that big and small OTT stream provider that they wish they can deploy on us.by phantomathkg
- It's all about who owns the keys to the machine. Attestation with our own keys is good for us. It becomes a problem when it's the manufacturer's key, the digital fiefdom owner's key or the government's key.
Remote attestation reveals the fact the computer belongs to corporations and governments. The user's attempts to claim ownership are "tampering".
- >But what about attacks after boot? That’s your EDR’s problem. Trusted boot provides the bedrock to build a bunch of other primitives on top of. Including cryptographic proof your EDR is installed and running (at boot), immutable filesystems (verified at boot), signed upgrades, confidential computing, etc. Without it you can’t trust your hosts themselves and can’t make further security guarantees. Houses built on sand and all that.
Good take - remote attestation doesn't solve all problems on its own but it is a very powerful tool in the platform security toolbox (and very cool "to boot" :P)
- We use SPIFFE/SPIRE at work. It works well for our use case, remote embedded workflows that need to phone home. It's very exacting: everything must be exactly right for the attestation to succeed. So it takes extra effort when you commit to that path.by imglorp
- The German Healthcare System is moving to the TelematikInfrastruktur 2.0, which has foundations in Zero Trust security, which includes also remote attestation and proof with TPM.
I had made a dummy client as example and I must say that on development perspectives, it is wild.
There are some Go libraries, which support only RSA instead of EC for TPM Keys, on the C++ side you get most of results in Windows through the CryptoProvider, on Linux and Mac exists own OS solutions/access.
Implementing it isn't trivial at all, otherwise you would already seen (not vibe-coded) open source implementions spawning on GitHub.
by madduci - > you get most of results in Windows through the CryptoProvider
Isn't that what you want on that platform? ADCS even supports issuing remote-attested TPM certs via EK, no need to reinvent the wheel.
> on Linux and Mac exists own OS solutions/access.
I'm not sure what the story is on MacOS, but on Linux the options are definitely lacking. From what I can tell, tpm2-openssl is the most mature solution, but that doesn't support binding to PCRs at all, and validating EK signatures on the server side is left as an exercise to the reader.
> Implementing it isn't trivial at all, otherwise you would already seen (not vibe-coded) open source implementions spawning on GitHub.
If I had to guess, I'd say another issue is that TPM remote attestation is seen as an "enterprise" feature. Open source projects like smallstep support it, but only via their paid enterprise offerings.
by lachiflippi - It's a nice idea, but I wouldn't design any system on the assumption that a TPM needs to stay secure for the system to be safe. There's been so many exploits. We can consider the iphone as an R & D platform for doing blackbox computations. In that nothing is allowed to run that Apple doesn't want. Protecting that is apples bread and butter and they care about it enough to value critical exploits in the millions. Yet people still find them all the time. I feel like if a company that invests millions in the concept can't make it secure then the concept probably isn't that great.by Uptrenda
- By that metric we should just pack it all up and call it a day on computing in general; because even despite literal trillions of dollars being spent on it, we still haven't found a way to make it secure.by klausa
- The iPhone is actually working really well. There has never been a widespread malware attack on the iphone. Only highly targeted attacks on individuals. And Apple even has an answer for this as well with Lockdown mode which renders all of those previous exploits impossible.
There's also Memory Integrity Enforcement on the iPhone 17 chips which makes all memory exploits detectable by the OS so it can trigger a reboot and report the bug to Apple.
And even when exploits are found, the boot chain attestation means rebooting your iphone always clears out any malware that made it past normal sandboxing. Particularly at risk individuals should enable lockdown mode and periodically reboot.
by Gigachad - GrapheneOS has an implementation of this with their Auditor app. You can use their service or you can use another Android. No freedom lost, just security gained.
There's also Android's hardware attestation API which apps can use to verify integrity in a more secure and privacy-respecting way than Google Play Integrity. An increasing number of apps are officially supporting GrapheneOS through this, and that number will only grow as GrapheneOS gains users.
https://grapheneos.org/articles/attestation-compatibility-gu...
by Cider9986 - > No freedom lost, just security gained
As far as I can tell, it flags unlocked bootloaders? So this is already huge freedom lost.
by matejdro - The auditor app itself does not result in any loss of freedom, but the widespread availability of remote attestation mechanisms on end-user devices incentivizes others to use it in a manner that does.
A purely local mechanism that lets the user check the integrity of their system is great. Making it easy for third parties to inspect it is a severe violation of user freedom and privacy.
by Zak - It would be a nice addition if big tech didn't abuse this to shove user-hostile software into devices which the user has paid for (like smartphones).. thanks to this attitude, whenever I see "remote attestation" I associate this with "hostile"..
> Using a TPM, we can remotely, cryptographically prove a couple of things:
Unless there are exploits..
by zb3 - I mean, all tech can be used in different ways. My experience has been much more on the preventing root kits side, rather then vendor lock in.
Yes, there can be exploits, but hardware exploits over a restricted interface (TPM2) are significantly rarer then normal software vulns. Everything is about risk mitigation, there is no perfect security.
by lcvw - > whenever I see "remote attestation" I associate this with "hostile"
HN is bizarre. This is just standard infrastructure security practice at any tech company of meaningful size. You are misunderstanding the target use case and audience of this article.
by solenoid0937