I’m a little unclear on this subject:
TPM chips to enable remote attestation. This mechanism works as follows. At boot time, the host computes a measurement list ML consisting of a sequence of hashes of the software involved in the boot sequence, namely the BIOS, the bootloader, and the software implementing the platform. The ML is securely stored inside the host’s TPM. To attest to the platform, a remote party challenges the platform running at the host with a nonce nU . The platform asks the local TPM to create a message containing both the ML and the nU , encrypted with the TPM’s private EK. The host sends the message back to the remote party who can decrypt it using the EK’s corresponding public key, thereby authenticating the host. By checking that the nonces match and the ML corresponds to a configuration it deems trusted, a remote party can reliably identify the platform on an untrusted host.
Lets say a TPM is in one of the nodes of a cluster (in the infrastrusture of cloud) . we know during boot time TPM startes performing integrity measurements : basically two way of doing this; 1-SRTM (Static Root of Trust for Measurements) (bios-bootloader-kernel) 2-DRTM (Dynamic Root of Trust for Measurements).(running applications : thats something unclear to me too).
those measurements are finally extended to the TPM and saved in the PCRs.
A user is willing to verify the integrity of the cloud platform ,thus a trusted third party has to verify that for him.And finally attest him with a response of trusted/untrusted platform .Lets apply it on the 1st quote.
- Remote attestation is for authenification or validating the integrity?
- Does the authenitification equals integrity of the platform?
- The TTP requests measurement list are those measurements meant to be hash values of SRTM and DRTM protocols?
- How does the trusted third party verifies those measurements?