wolfTPM is a portable TPM 2.0 stack with backward API compatibility designed for embedded use, and the newly released wolfTPM v3.0.0 provides examples for Secure Boot solutions to store a Root of Trust in non-volatile (NV) memory.
Secure Boot for your microcontroller is essential to protect against malware during the earliest stages of your system boot, and establishing a Root of Trust is the first step towards that direction. The example was implemented with our Secure Boot solution wolfBoot.
See the documentation examples/boot/README.md and docs/TPM.md for more details on how to set up a Root of Trust with authentication and tamper protection using wolfTPM.
The design in the example for storage of public key based Root of Trust into TPM entails using AES-CFB parameter encryption for all communication (salted and bound) and deriving a password based on unique device parameters used as “auth” to load NV (authenticate). The approach is to anchor the public key into the TPM NV storage such that it cannot be erased or tampered with. The NV stores a hash of the public key and wolfBoot keeps the public key internally and programs the TPM with the NV if not populated. The platform NV is locked and created under the platform hierarchy. It is recommended to supply a derived “authentication” value to prevent TPM tampering. This authentication value is encrypted on the bus.
If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.
Download wolfSSL Now