Re: SVSM initiated early attestation / guest secrets injection

["Jörg Rödel" <jroedel@suse.de>]

On Mon, Jan 16, 2023 at 05:13:00PM +0000, Daniel P. Berrangé wrote:
> IMHO it is undesirable to build a reliance on a specific bootloader.
> 
> My desire is that we have the stateful TPM in SVSM, such that once
> the UEFI firmware starts everything functions identically to how
> it would in bare metal or non-confidential VMs with a TPM. eg the
> ability to use all the normal Linux tools, and especially the
> standard systemd integration with LUKS and TPMs.

Yes, a secure stateful TPM is my goal as well. Btw, I thought a bit more
about your proposal, and if the injected secret at SVSM init time is the
TPM state, then the SVSM will keep the actual secret (== LUKS key) sealed
until the boot measurements (bootloader + configuration) happened.

This invalidates the attack I described earlier in this thread, as
injected software from the CSP still has no way to fake these
measurments to do the unsealing.

After the bootloader gets the LUKS key it can load kernel and initrd
from encrypted storage, so that there is no immediate need to measure
those.

Regards,

-- 
Jörg Rödel
jroedel@suse.de

SUSE Software Solutions Germany GmbH
Frankenstraße 146
90461 Nürnberg
Germany

(HRB 36809, AG Nürnberg)
Geschäftsführer: Ivo Totev, Andrew Myers, Andrew McDonald, Boudien Moerman