Cloud Native Computing Foundation Production Identity Day: SPIFFE + SPIRE 2020, 4 Dec 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Using DevIDs and TPMs for Node Attestation - Adriane Cardozo, Marcos Yedro

Description

Using DevIDs and TPMs for Node Attestation - Adriane Cardozo, Marcos Yedro

In this session we will present a proposal and demonstration for a TPM Node Attestor plugin following the TCG draft just published “TPM 2.0 Keys for Device Identity and Attestation” that applies the “IEEE Standard for Local and Metropolitan Area Networks, Secure Device Identity (802.1AR)“device identity module definition and formatting to keys protected by a TPM 2.

Don’t miss out! Join us at our upcoming event: KubeCon + CloudNativeCon Europe 2021 Virtual from May 4–7, 2021. Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.

A

Okay, hello, everyone, um my name is marcos cedro.

A

I am a software engineer at hpe and also an inspired contributor since a couple of years- and today, I'd like to share with you some work that we have been doing with um some folks at hpe, adrian cardozo and dorian lambert around using dev, ids and tpms for spire node attestation.

A

We base our work in two important uh industry standards. The first one is the igps standard for local and metropolitan area networks. Secure device identity. This document, which was published a couple of years ago, defined the concept of dev id. Probably some of you are already familiar with this concept, but in case in case you are not. uh Ld is essentially a cryptographic identity in the form of an expert online certificate with certain properties and protocols that make it suitable for device by the identification.

A

The standard defines two kinds of device: ids advait can be an iwd which is the the initial device identity that is created by the manufacturer at manufacturing time, and then we have the ldfid, which is the local identifier that is created by the administrator, and the other important document is the tcc tpm 2.0 keys for device, identity and attestation.

A

This document was released only a couple of months ago by the tcc, the trusted computing group. This group is the same that defined the dpm specification and in this opportunity they are releasing this this document when they are bringing us some recommendations for uh using dev ids with dpns.

A

So, essentially, these recommendations are around how the tpm must be provisioned, which kind of piece should be used in which, in which hierarchies in the dpm, these ldap, ids and ids must be placed another security and privacy considerations.

A

So, based on all this information and some previous work done by the community, we came up with this proposal. This is a diagram of the proposed nova tester, the it is very similar to the x 509 um position, a tester, but the main.

B

Difference is that.

A

The signing operation operation instead of being done in the asian itself, it is done in the dba which is isolated. So the the attestation workflow is uh the following. The first step, the the agent loads, the mit credentials.

C

A

Certificate plus the encrypted private key, the encrypted key, is loaded into the dpm. So now this this dpm is ready to perform sign-in operations and the.

B

A

Certificate is sent to the server side of the desktop. The address store, validate this certificate using a configured ca bundle if the validation succeeds, the server issues, the challenge to the agent- and this is an end once that needs to be signed. So the agent asks the tpm to sign this payload.

A

The dpm assigns it and sends it back to the agent and the asian sends uh the the payload sign into the server which finally uh verifies the signature using the device, and if it is successful that the attestation is confirmed so.

C

A

A few words how this this is a tester works, um there's a lot more going on. uh If you are interested in in this work here, you can see that the public did have issue where all this is being actively discussed.

A

uh So we are happy to to hear any comments or or feedback about it, and now I will hand it to adiani who's, going to run a live demo.

B

C

Oh, I think it's enough.

C

Sorry, let me share.

C

C

Can you see.

C

Okay, hello, everyone, so, uh okay, so as marcus presented, our plugin is similar to the x509 pop nodder test, but leverage the dev id based on the tcga draft, just published where the private key is protected by the tpm.

C

So here I'm connect to a physical server with a tpm2.0, and we already have a dev id provision here, we'll see then at the example later. So, let's take a look on the plugin configuration here so here in the server side we have our node tester plugin. We are calling tpm2 and we just need to configure the ca bundle path. This is the the ca that signed the device certificate.

C

Now, let's check the agent side.

C

So here is our plugin and we must configure the where the dev id certificate, private and public keys are so, as markus mentioned, the private blob is encrypted so and the key can only be used once it's loaded in the same tpm in which it was created. So after node attestation, when the agent proves the possession of the private key that is rooted in the ca bundle, we extract information from the dev id certificate to create the node selectors.

C

So, let's now see an example of a device certificate.

C

So this certificate we are creating using an internal provisioning tool that we have been working on. That is following the the spec that is. This is back, and here we can see that we have in the subject information about the device like the platform serial number.

C

We also have information in the extensions, so tcg recommends the use of digital signature only for the key usage dcg also defines some o ids. That must be present like this one. That means that the issue has valid validated the dev id residency, so in the during the provisioning means. The issue has checked that all the keys reside on the same tpm of a well-known vendor. By the way the tcg draft is under review, so this id has moved to the certificate policy field, so we need to update our provisioning tool later.

C

Tcg also specifies that the subject alternative name uh may contain information about the to identify the tpm, so as the tcgo ids. These data structures in use here are not recognized by the the opencs l2 yet, but it's not in there, it's just the the visualization okay. So this is the example of the dev id that we are using. Now.

C

Let's see it's working so here on the top, I will start the spy server and, let's just check there, is no a tested agent, okay and now, let's run here on the top on the bottom, this by uh agent to check the node at the station. So here you can see the know that the station was successful.

C

Let's see now the selectors that we have been, we are creating. So here you can see that now we have one a tested agent that used our plugin and we as similar to the x509 uh pop, not the test. We are using the fingerprint for the speech id and also has one selector.

C

We extract the information from the certificate, so you can see here the certificate serial number, each field uh value in the subject field and also in the issuer field. So for for each oid we have one selected and if there is a well known name, we also have this as a selector. So to help when creating the registration entries, we can think about extracting more information from the certificate.

C

Like uh those information in the subject, alternative name right, for example, the ip address right and one discussion that is being ongoing in the community- is to also add the pcr values as selectors. So this will require more change, but this is under discussion. So this completes our demo. This work is in progress, so we appreciate your feedback on this proposal and we are in the process to open source, the plugin and the provisioning tool to help on the discussions. So thank you.

C

Let's see if we have questions.

B

Thank you. I think we did see a couple of uh questions um so adrian, if you can answer, can you link the oid in the client certificate.

C

This one, let's go back, so we have id so here we have for each in the subject for each uh value. We have one selector.

C

So the code is generic right, so we just parse the values and create one select for each value here.

B

um I I think um zach has a bunch of questions. I don't know exactly from another mute to self. I don't see anything. Anyone else asking questions.

D

Oh, there was an extension that open ssl doesn't understand.

C

Yes, here right.

D

More about the the what object, identifier, that is.

C

This is, that's, is defined by the tcgo id, but openssl does not recognize that so for this one and and it was moved for to another field- the certificate policy. So I don't know if that's only adding in the dictionary in the openssl to be able to read and and present the well-known name right, but so far the opposition does not recognize that so.

D

That's right, I was, I guess I misunderstood. I was looking at the binary subject: alt name too.

C

Oh here here is the data structures.

D

So what what determines that data structure.

C

The tcga draft spec defines what structures that must be used to represent the tpm information to identify the tpm.

C

So this is, I didn't, enter in the details, because there are so many different uh and let's say, for the identity, there is a must field for the local devid. There is a uh should uh field, let's say information, and since we don't have any platform with either ids available. Yet this tool that we are working on following the spec is creating idf id and we are using as a local dvd in our plugin just for testing right.

C

So, but these are these the data structures in the dcg spec that defines which instructions must be used here.

D

C

It's harder model, that is the name, the hardware model, when the hardware.

D

These are fields, it's just open, ssl isn't transferring.

C

Yes, yes, that's that's not their horse, it's just because we it can pass uh presented. The well-known name, let's say just a numerical value.

D

It looks like somebody linked to the the tcg document. Okay, thank you.

C

D

um And then the the side myself, my follow up quite our sort of unrelated question is uh like from my understanding, most manufacturers, just kind of give you the ca and you don't necessarily have like the manufacturer certificate.

D

So how do you like tie this trust to, like the manufacturer, like how do you build your your database of serial numbers to bootstrap? This trust.

C

The idea is that we we sh, we must use the idev ids from the manufacturer, so we don't have that yet. But soon manufacturers will start uh shipping with this idf id and then we must have the ca to verify that and then we should have the local provision to create the ldf ids, based on the initial attestation keys that will be provided by the manufacturer.

C

So this the value of this is it's. The the hood of trust comes from the the manufacturers yeah, so just for testing that we are using uh like this way, creating uh not in the manufacturer right, because we don't have that yet available.

D

Got it? Thank you.

B

Great. Thank you.

E

I think that I just want to say uh kudos you're, relatively new to the projects, but you've you've entered with a bang and you've ramped up in a relatively short time and are driving something that is quite a meaningful contribution, alongside others in the team so kudos to you and welcome to the community.

C

E

Great demo, thanks.