When it comes to edge computing devices, keeping secrets such as encryption keys or identifiable metadata from being tampered with or stolen is of the utmost importance and the TPM is an ideal facility for keeping such secrets.
WolfTPM already has facilities for storing secrets to the TPM, but we’ve recently added convenience functions for sealing secrets to the TPM using policy authorization tied to PCR values, wolfTPM2_SealWithAuthSig, wolfTPM2_SealWithAuthKey and wolfTPM2_UnsealWithAuthSig. These functions also have NV versions for keeping persistent secrets. wolfTPM2_SealWithAuthSig uses a premade signature to seal the secret instead of a signing key so that the signing key can be kept externally.
Sealing secrets using policy this way not only keeps the secret stored safely within the TPM, but also restricts internal access to the secret, requiring a valid signature of the policyDigest used to seal it and that the PCR value matches the value it had at the time of sealing. This means that an attacker would need the key used to seal the secret and would need to gain access to the system without modifying the PCR values, so tying the PCR values to things like expected log output or the firmware image would lock an attacker out of the secret if those elements were modified.
Try these new functions for yourself with wolfTPM, for examples on how to use these new policy sealing function check out https://github.com/wolfSSL/wolfTPM/tree/master/examples/seal and https://github.com/wolfSSL/wolfTPM/tree/master/examples/nvram.
If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.
Download wolfSSL Now