Challenges in Bootstrapping Trust in Secure Hardware

Abstract

Thus far, we have discussed how to use various secure hardware mechanisms to bootstrap trust in a platform, in particular by using the secure hardware to monitor and report on the software state of the platform. Given the software state, the user (or an agent acting on the user’s behalf) can decide whether the platform should be trusted. Due to cost considerations, most commodity computers do not include a full-blown secure coprocessor such as the IBM 4758 [185]. Instead, the move has been towards cheaper devices such as the Trusted Platform Module (TPM) [213]. The cost reduction is due in part to the decision to make the TPM secure only against software attacks. As a consequence, a TPM in the physical possession of an adversary cannot be trusted.