Re: [GIT PULL] x86/txt for v2.6.32

[Pavel Machek <pavel@ucw.cz>]

On Sat 2009-10-03 13:44:22, Roland Dreier wrote:
> 
>  > > > So I modify the RAM content so that BIOS does not think measured
>  > > > environment existed before suspend?
> 
>  > And it is ridiculously easy to pull off, too:
>  > http://www.engadget.com/2008/02/21/cold-boot-disk-encryption-attack-is-shockingly-effective/
>  > 
>  > Shows the attack being used to read sensitive keys, but you can use it also
>  > to *modify* system running state (it will be more difficult, as you need to
>  > remove and replace the RAM while on S3 instead of S5, but it should be
>  > doable by someone who knows what he is doing).
> 
> I believe the whole point of this TXT / S3 handling is that the resume
> from S3 will then be able to detect that the contents of RAM have been
> modified while the system was asleep.

...and you are able to read out any keys, etc. Maybe that's expected &
ok, but Doc*/intel_txt.txt does not actually tell me what it protects
against and is pretty much useless... making patches impossible to
review.

So... what does txt protect?

Data integrity only?

Data privacy, too?

Who is it designed to protect against?

Remote attacker?

Local user trying to subvert it?

...and has soldering iron he's willing to use?

...and has soldering iron, osciloscope and PCI analyzer he's willing to use?

> TXT simply produces a reasonably trustworthy measurement of system
> state.  If you modify RAM while the system is asleep, then you will not
> be able to produce a measurement showing an unmodified system state.

Well, actually I see some auditing to be done in proposed patches.

									Pavel
-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html