LetsTrust

Hello Everybody,

here is the short and simple starting guide for the new LetsTrust-TPM2Go USB Stick, (LTT2Go).

1. As before: You need the Hardware itself, actually buyable here:
https://buyzero.de/products/letstrust-tpm2go
(The list will be updated with every new distributor that we can find)

2. Installation of the TSS and the TCTI-device driver
The simple way to archive a running stack with functional LTT2Go is to install the TSS. Like the LetsTrust-TPM for Raspberry Pi, you could easily use the tpm2_install.sh from https://github.com/PaulKissinger/LetsTrust
This script installs all necessary dependencies for the TSS and the tcti-driver for the LTT2Go, also the abrmd and the tpm2-tools will be installed.

3. Test the function of the LTT2Go:

Follow this https://github.com/tpm2-software/tpm2-tss/blob/master/doc/tcti-spi-ltt2go.md short guide and your LTT2Go should working!

4. Reset the LetsTrust-TPM2Go
https://github.com/PaulKissinger/LetsTrust-TPM2Go Here you'll find a short CLI tool to reset the TPM Chip on the LTT2Go. Use this tool for reboots of the host system or during the development phase. Normally there is no reason to reset a TPM while it is booted up.


That was everything for the short starting guide, and probably also for a long version '^__^.

Bye for now!

Paul

Hello Everybody,

here is the short and simple starting guide for the new LetsTrust-TPM2Go USB Stick, (LTT2Go).

1. As before: You need the Hardware itself, actually buyable here:
https://buyzero.de/products/letstrust-tpm2go
(The list will be updated with every new distributor that we can find)

2. Installation of the TSS and the TCTI-device driver
The simple way to archive a running stack with functional LTT2Go is to install the TSS. Like the LetsTrust-TPM for Raspberry Pi, you could easily use the tpm2_install.sh from https://github.com/PaulKissinger/LetsTrust
This script installs all necessary dependencies for the TSS and the tcti-driver for the LTT2Go, also the abrmd and the tpm2-tools will be installed.

3. Test the function of the LTT2Go:

Follow this https://github.com/tpm2-software/tpm2-tss/blob/master/doc/tcti-spi-ltt2go.md short guide and your LTT2Go should working!

4. Reset the LetsTrust-TPM2Go
https://github.com/PaulKissinger/LetsTrust-TPM2Go Here you'll find a short CLI tool to reset the TPM Chip on the LTT2Go. Use this tool for reboots of the host system or during the development phase. Normally there is no reason to reset a TPM while it is booted up.


That was everything for the short starting guide, and probably also for a long version '^__^.

Bye for now!

Paul

2023 August 8th,

Finally shipped to the stock \o/.
I hope you will find this usefull for your development!

Bye,

Paul

2023 August 2nd,

Update:
Shippment will start next week! \o/

Hello and welcome back,

Today, I would like to introduce my new product: LetsTrust-TPM2Go!

LetsTrust-TPM2Go is a USB 2.0 stick with a built-in TPM. It is designed to be compatible with Linux PCs or single-board computers that have USB-A ports (probably macOS but I could not test it). This product's main purpose is to simplify application development with TPM support. It can also be used if your embedded device is not ready or only has free USB ports on your target device.

Windows 11: LetsTrust-TPM2Go USB Stick is NOT compatible with Microsoft Windows 11 TPM 2.0 requirement!
Windows 10: LetsTrust-TPM2Go is not compatible [1].

Features:
- Infineon Optiga™ SLB 9672 TPM 2.0 FW15.23
- TCG Spec 2.0 Rev. 01.51
- USB 2.0 to SPI Bridge based on CY7C65211A
- Compatible with libusb
- Own USB VendorID/ProductID
- Tested with https://github.com/tpm2-software/
- available TCTI-Driver in tpm2_tss for plug & play usage [2]
- 2 LEDs, one for "USB-RX/TX action" and one connected to a TPM-GPIO for user feedback
- Transparent ABS housing for the PCB
- LetsTrust-TPM2Go was designed, manufactured, and tested in Bavaria, Germany.

Preorders are now open, and you can find LetsTrust-TPM2Go here: https://buyzero.de/products/letstrust-tpm2go

With the promo code TPMDEV2023, you'll get a 7€ discount on the first stick. This code is active till the end of August.


The first batch is manufactured, updated and tested.

The estimated shipment date is latest the end of July/beginning of August.
(We are waiting for the updated Vendor ID list on www.usb.org/developers, as this final lists Pi3g as a vendor with the given number, I could finalize the sticks (I want to avoid to scrapping several 1000€s for a potential typo))

usb.org updated the list:
https://usb.org/sites/default/files/usb_vids_080223.pdf

Shippment will start next week! \o/

Bye for now!

Paul


[1] I could interact with these sticks over WSL2 on Windows 10, but without an d-bus and the abrmd only simple commands are functional .

[2] https://github.com/tpm2-software/tpm2-tss/blob/master/doc/tcti-spi-ltt2go.md

Continue reading "More Hardware: LetsTrust-TPM2Go "

Hello and welcome back,

I'm really happy to announce the TPM.dev 2022 MiniConf 13. October this year!

You have to register here to get the conference link!


The schedule:

7:00 am Pacific Time / 4:00 pm CEST
The latest and greatest from OPTIGA™️ TPM, SLB9672 and SLB9673, Andreas Fuchs and Paul Kissinger from Infineon Technologies
7:30 am Pacific Time / 4:30 pm CEST
Disk integrity using microkernels and TPM, Sid Hussmann, CTO of Gapfruit, and Stefan Thöni
8:30 am Pacific Time / 5:30 pm CEST
Remote enrollment using sealed keys for Remote Attestation Ernesto Gomez Marin, Researcher at Infineon
9:30 am Pacific Time / 6:30 pm CEST
Remote Attestation of the UEFI Event log using Keylime, Thore Sommer, maintainer of Keylime
10:30 am Pacific Time / 7:30 pm CEST
Maintaining anchors of trust, Michael Richardson known from his RATS work at IETF and other workgroups
11:30 am Pacific Time / 8:30 pm CEST
How OpenSecurityTraining2 will help spread TPM and Trusted Computing awareness, Xeno Kovah, Founder of Open Security Training

I'll be there and you?

Bye for now!

Paul

Hello and welcome back,

Dimitar from tpm.dev shared a new project:" EnactTrust, Attestation as a Service"

Dimitar allowed me to copy the article and share it with you

The article was copied from tpm.dev, Author Dimitar Tomov, https://developers.tpm.dev/posts/enacttrust)

#####
Hello everyone,

Today, I want to share with our community something that a small group of us have built to help raise the adoption of some of TPM's advanced features:

Attestation as a Service

Mitko Vasilev who helped figure out the building blocks gives this overview:

EnactTrust is Remote Attestation as a Service for Linux and Windows systems with TPM chips.

You can use the TPM hardware root of trust for reporting to verify the integrity of any file or application on the system.

Svetlozar Kalchev who helped build our cloud infrastructure, backend, and frontend, is eager to welcome early adopters and asked me to share just this line:

We are excited to announce that signups for the EnactTrust beta are now open!

You can sign-up for our beta here.



Now, let's get down to the nitty-gritty details of how our beta works:

- Using our open-source agent app you can attest up to three nodes. The number of nodes can be unlimited. We are starting with up to three nodes just for the beta.
- EnactTrust agent app currently has two flavors - C and Golang.
- EnactTrust agent app generates Attestation Keys under the Owner Hierarchy of the TPM.
- EnactTrust agent app does not use the TPM's EK public key. We want to preserve the privacy of the user's TPM and user's node that will be attested because we expect most will first test on personal computers.
- EnactTrust backend for the public beta is cloud-based, although it could also be run on-premise. We want to offer something easy to try that does not depend on centralized servers. This is a major difference between EnactTrust and Microsoft AzureSphere or Intel's SGX.
- Every user has his own dashboard that is web-based. It is written in React.
- After you sign up for the beta, we will send you a unique user ID. Using this user ID you could log in to your EnactTrust dashboard.
- At the first launch of the EnacTrust agent on a new node, you have to enter your unique user ID and your node will be automatically added to your dashboard.
- Everyone who signups for our beta will be contacted when we launch EnactTrust.

I will pause with details for now and ask for feedback and questions. To join our beta sign-up here.

#####

You could join the beta phase here: https://enacttrust.com

I'll try EnactTrust on the Pi with one LetsTrust-TPM,


Bye for now!

Paul

Hello and welcome,

today I'll want to introduce Johannes Holland, a really nice guy, MSc, and TPM addicted.
I know Johannes personally and he also tested and validated the first revision of the LetsTrust-Arduino adapter, for which I am very grateful to this day!

And you all know Peter Huewe? He was the driver behind this.

At the next Open Source Summit, Johannes and Peter will speak over the TSS FAPI and the abstract gives great hope for an informative session.

The abstract:

Nowadays, virtually all consumer PCs/laptops contain a TPM2.0 security chip, the Trusted Platform Module. Moreover, the TPM finds its way into more and more modern embedded devices. But what is the TPM and how can we use it on Linux? The TPM has the potential to enhance security in a variety of use cases ranging from SSH, VPN, disk encryption, and more. Since it is so powerful, it may be hard to use at times. But do not fret - the tpm2-software project, especially its new TPM Software Stack (TSS) Feature API (FAPI) library, enables anyone to use the TPM. This talk gives an introduction on how to use the TPM the easy way, using recent contributions to the TPM ecosystem like the TSS FAPI. After a brief overview of the involved hard- and software, this talk will dive into how to get started with the TPM and show how it can be used to perform fundamental security tasks. Afterwards, recent additions like the TPM PKCS11 middleware and the OpenSSL engine will be presented - enabling TPM integration, perhaps without writing a single line of code. In the end, the TPM open source ecosystem will be discussed, and how to become part of it. Want to start hacking? We got you.

Here you find the link to the session
https://osseu2020.sched.com/event/eCJc/using-the-tpm-its-not-rocket-science-anymore-johannes-holland-peter-huewe-infineon-technologies-ag


Bye for now!

Paul

Hello and welcome!

Today a hint to the tpm.dev miniConf (online)

Short facts:
2 Days
10 Speakers
7 am PDT / 17:00 EEST 21st of October
7 am PDT / 17:00 EEST 22st of October

The speakers come from: tpm.dev, IBM, embed, wolfSSL, Nokia Bell Labs, Google, Intel and RedHat!

The schedule:

Day 1 - 21st of October

7 am PDT / 17:00 EEST
Making Remote Attestation a mass practice
Dimitar Tomov, Founder of TPM.dev

8 am PDT / 18:00 EEST
TBC / Trusted Computing and UEFI
Ken Goldman, IBM

9 am PDT / 19:00 EEST
Trustworthy 2020 Platforms: Mighty Mini AMD for Digital Work, Play, and Currencies
Piotr Król, 3mdeb

10 am PDT / 20:00 EEST
(working title) Real-life examples of wolfTPM and wolfBoot
David Garske, wolfSSL

Day 2 - 22nd of October

7 am PDT / 17:00 EEST
Attestation meets Safety-Critical Systems
Ian Oliver, Nokia Bell Labs

8 am PDT / 18:00 EEST
Remote Attestation at Enterprise Scale
Mathew Garret, Google

9 am PDT / 19:00 EEST
TBC / What’s next for TSS2, FAPI and PKCS 11
William Roberts, Intel

10 am PDT / 20:00 EEST
The Secure Enclaves and Attestation
Ilhan Gurel

11 am PDT / 21:00 EEST
An introduction to Keylime’s Remote Attestation
Michael Peters, RedHat


https://developers.tpm.dev/events/day1-tpmdev-miniconf-2020?instance_index=20201021T140000Z

https://developers.tpm.dev/events/day2-tpmdev-miniconf-2020?instance_index=20201022T140000Z


I will join, and you?

Please, read the next recommendation for the end of October: https://letstrust.de/archives/34-A-recommendation!.html

Bye for now!

Paul

Hello and welcome,

I've got a link from a good friend of mine, and I want to share this with you:

https://github.com/drandreas/zephyr-tpm2-poc

Proof of Concept: Zepher TPM2 Software Stack
Overview

This repo tests the requirements (Code size and Memory size) for running tpm2-tss on Zephyr. The PoC is implemented on top of the Enhanced System API (ESAPI), since the Feature API (FAPI) adds additional dependencies to JSON-C and OpenSSL. Moreover, the tpm2-tools are also implemented on top of ESAPI, therefore the ESAPI should be sufficient.

And I'm really proud to see the first public-project that used the "new" Arduino2LetsTrust-Header. (I'll introduce the ArduinoAdapter in the next few days).


Bye for now!

Paul

Hello and welcome back!

Today I'm really happy and proud to introduce a new community around TPMs:

https://tpm.dev/

Tpm.dev was founded by Dimitar Tomov is a smart guy and he wants the same thing as I: Secure the world, a little more.

tpm.dev wants to be a platform:
To discuss security toppings. (mostly TPM related)
For help if you stuck on your project. (offside an old school mailing list)
Collect more useful stuff around TPMs and OpenSourceSoftware for that.

And between Lockdown there is a funny little meetup every wednesday over MS-Teams. Really interesting people are there (some of them are customers of LetsTrust-TPMs ^__^)


So feel free to join the community!

Bye for now!

Paul

Welcome back!

A few weeks ago Mr. M.P. write me an email with the question: May it possible to drive two TPMs on one Pi (4)?

Mr. M., want to drive one native TPM for the Pi and a second TPM as a remote vTPM for a client application.

So i've tested the Hardware Setting for Mr. M., after a few Minutes and combine this two posts:
1) https://letstrust.de/archives/23-Move-LetsTrust-TPMs-to-CS0.html
2) https://letstrust.de/archives/20-Mainline.html

Here the results:

Electrical- and mechanical-setting:


Hardware configuration of the two TPMs:

and you'll need 2 TPMs, with one 0Ohm Resistor on position CS0. [1]


Linux log



I hope this will be helpful for you, too.


Bye for now!

Paul


[1]
References:
https://letstrust.de/archives/24-Hardware-update!.html
https://letstrust.de/uploads/letstrust-v2.2.placement.cs0.pdf
https://letstrust.de/uploads/letstrust-v2.2.placement.cs1.pdf