Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1568787

Re: [tpmdd-devel] [RFC] tpm2-space: add handling for global session exhaustion

Show all headers | View raw

On Fri, 2017-01-27 at 16:35 -0700, Jason Gunthorpe wrote:
> On Fri, Jan 27, 2017 at 02:04:59PM -0800, James Bottomley wrote:
> 
> > if I look at the code I've written, I don't know what the session
> > number is, I just save sessionHandle in a variable for later use 
> > (lets say to v1).  If I got the same session number returned at a 
> > later time and placed it in v2, all I'd notice is that an 
> > authorization using v1 would fail.
> 
> Is there any way that could be used to cause an op thinking it is
> using v1 to authorize something it shouldn't?

Not really: in the parameter or HMAC case, you have to compute based on
the initial nonce given by the TPM when the session was created. 
 Assuming the initial nonce belonged to the evicted session, the HMAC
will now fail because the nonce of the v2 session is different.  There
is a corner case where you track the nonce in a table indexed by
handle, so when v2 is created, its nonce replaces the old v1 nonce in
the table.  Now you can use v1 and v2 without error (because use picks
up the correct nonce) and effectively they're interchangeable as the
same session.  Even in this case, you're not authorising something you
shouldn't, you're just using one session for the authorisations where
you thought you had two.

James

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[RFC] tpm2-space: add handling for global session exhaustion James Bottomley <James.Bottomley@HansenPartnership.com> - 2017-01-18 21:50 +0100
  Re: [tpmdd-devel] [RFC] tpm2-space: add handling for global session  exhaustion Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> - 2017-01-19 13:30 +0100
    Re: [tpmdd-devel] [RFC] tpm2-space: add handling for global session  exhaustion Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> - 2017-01-19 13:50 +0100
      Re: [tpmdd-devel] [RFC] tpm2-space: add handling for global session  exhaustion James Bottomley <James.Bottomley@HansenPartnership.com> - 2017-01-27 23:10 +0100
    Re: [tpmdd-devel] [RFC] tpm2-space: add handling for global session  exhaustion James Bottomley <James.Bottomley@HansenPartnership.com> - 2017-01-19 14:10 +0100
      Re: [tpmdd-devel] [RFC] tpm2-space: add handling for global session  exhaustion Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> - 2017-01-20 14:50 +0100
  Re: [tpmdd-devel] [RFC] tpm2-space: add handling for global session  exhaustion James Bottomley <James.Bottomley@HansenPartnership.com> - 2017-01-27 23:10 +0100
    Re: [tpmdd-devel] [RFC] tpm2-space: add handling for global session  exhaustion James Bottomley <James.Bottomley@HansenPartnership.com> - 2017-01-28 01:00 +0100
    Re: [tpmdd-devel] [RFC] tpm2-space: add handling for global session  exhaustion Jason Gunthorpe <jgunthorpe@obsidianresearch.com> - 2017-01-28 01:00 +0100
    Re: [RFC] tpm2-space: add handling for global session exhaustion Ken Goldman <kgoldman@us.ibm.com> - 2017-01-30 02:10 +0100
      Re: [tpmdd-devel] [RFC] tpm2-space: add handling for global session  exhaustion James Bottomley <James.Bottomley@HansenPartnership.com> - 2017-01-30 17:20 +0100

csiph-web