qemu-devel.nongnu.org archive mirror
 help / color / mirror / Atom feed
* [Qemu-devel] Choosing PCR banks for swtpm's TPM 2
@ 2018-06-25 15:05 Stefan Berger
  2018-06-25 15:18 ` Dr. David Alan Gilbert
                   ` (2 more replies)
  0 siblings, 3 replies; 14+ messages in thread
From: Stefan Berger @ 2018-06-25 15:05 UTC (permalink / raw)
  To: tpm2, Kenneth Goldman
  Cc: Chris Friesen, Marc-André Lureau, qemu-devel, Qi, Yadong,
	Xu, Quan

Hi!

  I am sending this email to solicit input on the choice of the PCR 
banks to enable for swtpm's TPM 2. I have currently enabled 4 PCR banks 
for SHA{1,256,384,512}. The downside of this is that running the TPM 2 
with so many PCR banks has a performance impact when the Linux integrity 
measurement architecture is used and has to extend measurements into all 
PCR banks, which Linux does already.

TPM 2 has the PCR_Allocate() command for a user to select the PCR banks 
to use. This command allows to make some PCR banks invisible. The change 
has to be done through the firmware and has the downside that the TPM2 
does not support TPM2_Shutdown(SU_STATE) after this command was used. 
This prevents suspend/resume from working properly. So, it seems that 
one shouldn't have to use this command, which in turn means the number 
of PCR banks should be small.

Another complication with the swtpm is the upgrade path. Suspended VMs 
will expect that the PCR banks that were available before the suspend 
will be available after the resume and a possible swtpm upgrade. This in 
turn means that the PCR banks should be chosen now and we'll have to 
stick with them.

That said, my suggestion would be to enable only PCR banks for SHA256 
for 'now' and SHA512 for the future. Having two PCR banks should enable 
decent performance. If someone wants to have better performance he will 
have to go through the firmware to select the PCR banks at the expense 
of loosing suspend/resume support.

The change of PCR banks for the current 4 PCR banks will break the state 
of all swtpms.

If you have suggestions, please let me know.

Regards,

    Stefan

^ permalink raw reply	[flat|nested] 14+ messages in thread

end of thread, other threads:[~2018-06-25 19:44 UTC | newest]

Thread overview: 14+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-06-25 15:05 [Qemu-devel] Choosing PCR banks for swtpm's TPM 2 Stefan Berger
2018-06-25 15:18 ` Dr. David Alan Gilbert
2018-06-25 15:22   ` Stefan Berger
2018-06-25 15:29     ` Dr. David Alan Gilbert
2018-06-25 15:54       ` Stefan Berger
2018-06-25 16:11         ` Dr. David Alan Gilbert
2018-06-25 16:23           ` Stefan Berger
2018-06-25 15:25 ` Daniel P. Berrangé
2018-06-25 15:56   ` Stefan Berger
2018-06-25 15:59     ` Daniel P. Berrangé
2018-06-25 16:08       ` Stefan Berger
2018-06-25 16:10         ` Daniel P. Berrangé
2018-06-25 16:15           ` Stefan Berger
2018-06-25 19:44 ` Stefan Berger

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).