Re: Coconut-SVSM - vTPM support for Intel TD Partitioning

[James Bottomley <James.Bottomley@HansenPartnership.com>]

On Thu, 2024-08-01 at 22:38 +0000, Yao, Jiewen wrote:
> Hi
> As follow up, we have drafted the vTPM document and put to
> https://github.com/intel-staging/td-partitioning-svsm/blob/svsm-tdp-vtpm/Documentation/TD%20Partitioning%20based%20virtual%20TPM%20Design%20Guide%20Rev%200.5.1.pdf
> .
> It describes the current TD Partitioning based vTPM design.

So this design follows what was in the ephemeral vTPM paper

https://dl.acm.org/doi/abs/10.1145/3627106.3627112

and is what IBM demoed at LPC.  However, the weakness in this design is
that there's no challenge for the platform attestation used in place of
the EK certificate.  We tried to argue around that because the
ephemeral EK changes on every boot and should thus mitigate any replay
concerns, but that can't extend to a stateful vTPM and we needed to
support both (and letting the attesting party provide the nonce even in
terms of the EK hash is still not good security practice).  That's why
the SVSM API includes a vTPM attestation protocol that allows the
external verifier to provide a nonce and dispenses with the EK cert
emulation protocol.

Regards,

James