{"id":52697,"date":"2019-11-14T00:00:00","date_gmt":"2019-11-13T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/uyazvimost-tpm-fail-pozvolyayushhaya-vosstanovit-klyuchi-hranimye-v-tpm-modulyah"},"modified":"2020-02-18T14:00:29","modified_gmt":"2020-02-18T11:00:29","slug":"uyazvimost-tpm-fail-pozvolyayushhaya-vosstanovit-klyuchi-hranimye-v-tpm-modulyah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/az\/blog\/news\/uyazvimost-tpm-fail-pozvolyayushhaya-vosstanovit-klyuchi-hranimye-v-tpm-modulyah","title":{"rendered":"TPM-Fail z\u0259ifliyi, TPM modullar\u0131nda saxlan\u0131lan a\u00e7arlar\u0131 b\u0259rpa etm\u0259y\u0259 imkan tan\u0131y\u0131r","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Worcester Polytechnic Institute, L\u00fcbeck University v\u0259 Kaliforniya Universiteti San-Diyegoda bir qrup t\u0259dqiqat\u00e7\u0131 haz\u0131rlam\u0131\u015fd\u0131r<\/a><\/noindex> \u00fc\u00e7\u00fcnc\u00fc t\u0259r\u0259f kanallar\u0131 il\u0259 h\u00fccum metodunu, bu metod TPM-d\u0259 (Trusted Platform Module) saxlan\u0131lan gizli a\u00e7arlar\u0131n d\u0259y\u0259rini b\u0259rpa etm\u0259y\u0259 imkan yarad\u0131r. H\u00fccumun kod ad\u0131 TPM-Fail<\/a><\/noindex> olarak t\u0259yin edilib v\u0259 Intel \u015firk\u0259tin\u0259 m\u0259xsus fTPM-i (firmaya \u0259saslanan proqram realla\u015fmas\u0131<\/a><\/noindex> , CPU daxilind\u0259 ayr\u0131lm\u0131\u015f mikrosxemd\u0259 i\u015fl\u0259yir) CVE-2019-11090 kodlamas\u0131 v\u0259 STMicroelectronics \u00e7ipind\u0259ki hardware TPM-l\u0259ri ST33<\/a><\/noindex> (CVE-2019-16863).<\/p>\n

T\u0259dqiqat\u00e7\u0131lar n\u0259\u015fr edibl\u0259r<\/a><\/noindex> h\u00fccum \u00fc\u00e7\u00fcn al\u0259t komplektinin prototipini t\u0259qdim etdil\u0259r v\u0259 ECDSA v\u0259 EC-Schnorr \u0259sasl\u0131 alqoritml\u0259rl\u0259 r\u0259q\u0259msal imzalar\u0131n yarad\u0131lmas\u0131nda istifad\u0259 olunan 256-bitlik gizli a\u00e7ar\u0131 b\u0259rpa etm\u0259nin m\u00fcmk\u00fcns\u00fczl\u00fcy\u00fcn\u00fc g\u00f6st\u0259rdil\u0259r. \u0130caz\u0259l\u0259r\u0259 g\u00f6r\u0259, Intel fTPM sisteml\u0259rin\u0259 olan \u00fcmumi h\u00fccum m\u00fcdd\u0259ti 4-20 d\u0259qiq\u0259 aras\u0131ndad\u0131r v\u0259 1-15 min \u0259m\u0259liyyat\u0131n t\u0259hlilini t\u0259l\u0259b edir. ST33 \u00e7ipli sisteml\u0259r\u0259 h\u00fccum etm\u0259k \u00fc\u00e7\u00fcn is\u0259 t\u0259xmin\u0259n 80 d\u0259qiq\u0259 vaxt v\u0259 40 min r\u0259q\u0259msal imza istehsal\u0131 \u0259m\u0259liyyat\u0131n\u0131 analiz etm\u0259k laz\u0131md\u0131r. <\/p>\n

T\u0259dqiqat\u00e7\u0131lar h\u0259m\u00e7inin y\u00fcks\u0259k s\u00fcr\u0259tli \u015f\u0259b\u0259k\u0259l\u0259rd\u0259 uzaqdan h\u00fccumun h\u0259yata ke\u00e7irilm\u0259sinin m\u00fcmk\u00fcnl\u00fcy\u00fcn\u00fc n\u00fcmayi\u015f etdirdil\u0259r. Bu, laboratoriya \u015f\u0259raitind\u0259 1GB s\u0131nma g\u00fcc\u00fcn\u0259 malik yerli \u015f\u0259b\u0259k\u0259d\u0259 be\u015f saat \u0259rzind\u0259 gizli a\u00e7ar\u0131n b\u0259rpas\u0131n\u0131 m\u00fcmk\u00fcn etdi, VPN serveri il\u0259 45 min autentifikasiya sessiyas\u0131 \u00fc\u00e7\u00fcn cavab vaxt\u0131n\u0131n \u00f6l\u00e7\u00fclm\u0259sind\u0259n sonra, gizli a\u00e7arlar\u0131n\u0131 z\u0259if TPM-d\u0259 saxlayan software strongSwan bazas\u0131nda.<\/p>\n

H\u00fccum metodu r\u0259q\u0259msal imzan\u0131n yarad\u0131lmas\u0131 prosesind\u0259 \u0259m\u0259liyyatlar\u0131n icra vaxt\u0131nda ba\u015f ver\u0259n f\u0259rql\u0259rin t\u0259hlilin\u0259 \u0259saslan\u0131r. Hesablama i\u015fl\u0259ri zaman\u0131 \u00e7a\u011f\u0131r\u0131lan gecikm\u0259l\u0259rin qiym\u0259tl\u0259ndirilm\u0259si m\u00fc\u0259yy\u0259n bitl\u0259r haqq\u0131nda m\u0259lumat \u0259ld\u0259 etm\u0259y\u0259 imkan tan\u0131y\u0131r, el\u0259c\u0259 d\u0259 ellips kordunu \u0259hat\u0259 ed\u0259n \u0259m\u0259liyyatlar zaman\u0131 skalarla \u00e7oxaltma zaman\u0131. ECDSA \u00fc\u00e7\u00fcn, init vektoru (nonce) haqq\u0131nda olan m\u0259lumatla bir ne\u00e7\u0259 bitin t\u0259sniqi bel\u0259, h\u00fccumu h\u0259yata ke\u00e7ir\u0259r\u0259k b\u00fct\u00fcn gizli a\u00e7ar\u0131n ard\u0131c\u0131l b\u0259rpas\u0131n\u0131 m\u00fcmk\u00fcns\u00fcz edir. U\u011furlu h\u00fccum \u00fc\u00e7\u00fcn, m\u0259lum olan h\u00fccum\u00e7unun veril\u0259nl\u0259rind\u0259n istifad\u0259 ed\u0259n bir ne\u00e7\u0259 min r\u0259q\u0259msal imzan\u0131n yarad\u0131lmas\u0131 zaman\u0131 gecikm\u0259 analizi t\u0259l\u0259b olunur.<\/p>\n

Z\u0259iflik aradan qald\u0131r\u0131l\u0131b<\/a><\/noindex> STMicroelectronics \u015firk\u0259tinin yeni \u00e7ip versiyalar\u0131nda, ECDSA alqoritminin h\u0259yata ke\u00e7irilm\u0259si \u0259m\u0259liyyatlar\u0131n\u0131n icra vaxt\u0131na g\u00f6r\u0259 korrelyasiyalardan azad oldu\u011funu s\u00fcbut edir. Maraql\u0131d\u0131r ki, STMicroelectronics \u00e7ipind\u0259 olan bu problemd\u0259n \u0259ziyy\u0259t \u00e7\u0259k\u0259n \u00e7ip, CommonCriteria (CC) EAL 4+ t\u0259hl\u00fck\u0259sizlik s\u0259viyy\u0259sin\u0259 uy\u011fun avadanl\u0131qlarda da istifad\u0259 edilir. T\u0259dqiqat\u00e7\u0131lar Infineon v\u0259 Nuvoton \u015firk\u0259tinin TPM \u00e7ipl\u0259rini d\u0259 yoxlad\u0131lar, lakin onlarda hesablamalar\u0131n vaxt d\u0259yi\u015fm\u0259si \u0259sas\u0131nda s\u0131zma a\u015fkar edilm\u0259di.<\/p>\n

Intel prosessorlar\u0131nda problem 2013-c\u00fc ild\u0259n istehsal olunan Haswell ail\u0259si il\u0259 ba\u015flay\u0131r. Problemin Dell, Lenovo v\u0259 HP kimi m\u00fcxt\u0259lif istehsal\u00e7\u0131lar t\u0259r\u0259find\u0259n istehsal olunan geni\u015f \u00e7e\u015fidd\u0259 noutbuklar, PC v\u0259 serverl\u0259r\u0259 t\u0259sir etdiyi qeyd olunur.<\/p>\n

Intel \u015firk\u0259ti noyabr<\/a><\/noindex> firmware yenil\u0259m\u0259sin\u0259 daxil edib<\/a><\/noindex> dig\u0259r 24 t\u0259hl\u00fck\u0259sizliy\u0259 qar\u015f\u0131 z\u0259iflikl\u0259 yana\u015f\u0131, onlardan doqquzu y\u00fcks\u0259k t\u0259hl\u00fck\u0259 s\u0259viyy\u0259sin\u0259, biri is\u0259 kritik d\u0259r\u0259c\u0259y\u0259 malikdir. Bu z\u0259iflikl\u0259rl\u0259 ba\u011fl\u0131 yaln\u0131z \u00fcmumi m\u0259lumatlar verilir, m\u0259s\u0259l\u0259n, kritik z\u0259ifliyin (CVE-2019-0169) \u0130ntel CSME (Birl\u0259\u015fmi\u015f T\u0259hl\u00fck\u0259sizlik v\u0259 \u0130dar\u0259etm\u0259 M\u00fch\u0259ndisliyi) v\u0259 Intel TXE (\u0130naml\u0131 \u0130cra M\u00fch\u0259ndisliyi) m\u00fchitl\u0259rind\u0259 y\u0131\u011f\u0131n a\u015f\u0131rmas\u0131 yaratma imkan\u0131ndan qaynaqland\u0131\u011f\u0131, bu da h\u00fccum\u00e7unun imtiyazlar\u0131n\u0131 art\u0131rmas\u0131na v\u0259 gizli m\u0259lumatlara daxil olmas\u0131na imkan tan\u0131y\u0131r.<\/p>\n

H\u0259m\u00e7inin qeyd etm\u0259k olar ki, auditoriya<\/a><\/noindex> izolyasiya olunmu\u015f enclave-l\u0259rd\u0259 icra olunan kodla qar\u015f\u0131l\u0131ql\u0131 \u0259laq\u0259d\u0259 olan m\u00fcxt\u0259lif SDK-lar\u0131n audit n\u0259tic\u0259l\u0259rinin a\u00e7\u0131qlanmas\u0131. H\u00fccum ssenaril\u0259rini h\u0259yata ke\u00e7irm\u0259k \u00fc\u00e7\u00fcn istifad\u0259 oluna bil\u0259c\u0259k probleml\u0259ri a\u015fkar etm\u0259k m\u0259qs\u0259dil\u0259 sekiz SDK ara\u015fd\u0131r\u0131lm\u0131\u015fd\u0131r: Intel SGX-SDK<\/a><\/noindex>, SGX-LKL<\/a><\/noindex>, Microsoft OpenEnclave<\/a><\/noindex>, Graphene<\/a><\/noindex>,
\nRust-EDP<\/a><\/noindex> v\u0259 Google Asylo<\/a><\/noindex> Intel SGX \u00fc\u00e7\u00fcn, Keystone<\/a><\/noindex> RISC-V \u00fc\u00e7\u00fcn v\u0259 Sancus<\/a><\/noindex> Sancus TEE \u00fc\u00e7\u00fcn. Audit zaman\u0131 ayr\u0131l\u0131b<\/a><\/noindex> 35 z\u0259iflik a\u015fkar edilib ki, bu da enclave-d\u0259n AES a\u00e7arlar\u0131n\u0131 \u00e7\u0131xarmaq v\u0259 ya yadda\u015f\u0131n m\u0259zmununu pozmaqla \u00f6z kodunu icra etm\u0259y\u0259 imkan ver\u0259n bir ne\u00e7\u0259 h\u00fccum ssenarisi inki\u015faf etdirm\u0259y\u0259 imkan tan\u0131y\u0131r.<\/p>\n

\"TPM-Fail<\/a><\/noindex><\/center><\/p>\n

<\/a><\/noindex><\/p>\n

M\u0259nb\u0259: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0412\u0443\u0441\u0442\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u043f\u043e\u043b\u0438\u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0438\u043d\u0441\u0442\u0438\u0442\u0443\u0442\u0430, \u041b\u044e\u0431\u0435\u043a\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0438 \u041a\u0430\u043b\u0438\u0444\u043e\u0440\u043d\u0438\u0439\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432 \u0421\u0430\u043d-\u0414\u0438\u0435\u0433\u043e \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0430 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u043f\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u043c \u043a\u0430\u043d\u0430\u043b\u0430\u043c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u0437\u0430\u043a\u0440\u044b\u0442\u044b\u0445 \u043a\u043b\u044e\u0447\u0435\u0439, \u0445\u0440\u0430\u043d\u0438\u043c\u044b\u0445 \u0432 TPM (Trusted Platform Module). \u0410\u0442\u0430\u043a\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f TPM-Fail \u0438 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 fTPM (\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u0430\u044f \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f \u043d\u0430 \u0431\u0430\u0437\u0435 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0430\u044f \u043d\u0430 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e\u043c \u043c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0435 \u0432\u043d\u0443\u0442\u0440\u0438 CPU) \u043e\u0442 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Intel (CVE-2019-11090) \u0438 \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":52698,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-52697","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47TPM-Fail z\u0259ifliyi, TPM-modullar\u0131nda saxlan\u0131lan a\u00e7arlar\u0131 b\u0259rpa etm\u0259y\u0259 imkan verir | ProHoster","description":"Worcester Polytechnic Institute, L\u00fcbeck University v\u0259 Kaliforniya Universiteti San-Diyegoda bir qrup t\u0259dqiqat\u00e7\u0131","canonical_url":"https:\/\/prohoster.info\/az\/blog\/news\/uyazvimost-tpm-fail-pozvolyayushhaya-vosstanovit-klyuchi-hranimye-v-tpm-modulyah","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"az_AZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c TPM-Fail, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043a\u043b\u044e\u0447\u0438, \u0445\u0440\u0430\u043d\u0438\u043c\u044b\u0435 \u0432 TPM-\u043c\u043e\u0434\u0443\u043b\u044f\u0445 | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0412\u0443\u0441\u0442\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u043f\u043e\u043b\u0438\u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0438\u043d\u0441\u0442\u0438\u0442\u0443\u0442\u0430, \u041b\u044e\u0431\u0435\u043a\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0438 \u041a\u0430\u043b\u0438\u0444\u043e\u0440\u043d\u0438\u0439\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432 \u0421\u0430\u043d-\u0414\u0438\u0435\u0433\u043e","og:url":"https:\/\/prohoster.info\/az\/blog\/news\/uyazvimost-tpm-fail-pozvolyayushhaya-vosstanovit-klyuchi-hranimye-v-tpm-modulyah","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-13T21:00:00+00:00","article:modified_time":"2020-02-18T11:00:29+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"52697","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 04:30:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:38:25","updated":"2026-01-24 04:30:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/posts\/52697","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/comments?post=52697"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/posts\/52697\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/media\/52698"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/media?parent=52697"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/categories?post=52697"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/tags?post=52697"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}