Messages in this thread |  | | From | Matthew Garrett <> | Date | Sat, 14 Jan 2023 19:05:03 -0800 | Subject | Re: [PATCH v5 03/11] tpm: Allow PCR 23 to be restricted to kernel-only use |
| |
On Sat, Jan 14, 2023 at 6:55 AM James Bottomley <jejb@linux.ibm.com> wrote: > Can we go back again to why you can't use locality? It's exactly > designed for this since locality is part of creation data. Currently > everything only uses locality 0, so it's impossible for anyone on Linux > to produce a key with anything other than 0 in the creation data for > locality. However, the dynamic launch people are proposing that the > Kernel should use Locality 2 for all its operations, which would allow > you to distinguish a key created by the kernel from one created by a > user by locality. > > I think the previous objection was that not all TPMs implement > locality, but then not all laptops have TPMs either, so if you ever > come across one which has a TPM but no locality, it's in a very similar > security boat to one which has no TPM.
It's not a question of TPM support, it's a question of platform support. Intel chipsets that don't support TXT simply don't forward requests with non-0 locality. Every Windows-sticker laptop since 2014 has shipped with a TPM, but the number that ship with TXT support is a very small percentage of that. I agree that locality is the obvious solution for a whole bunch of problems, but it's just not usable in the generic case.
|  |