infineon/remote-attestation-optiga-tpm

Setup and operation guide for OPTIGA™ TPM backed remote attestation on a Linux system

Introduction

Remote attestation is a mechanism to enable a remote system (server) to determine the integrity of a platform of another system (Raspberry Pi®). In a Linux-based system, a security feature known as the Integrity Measurement Architecture (IMA) can be used to capture platform measurements. Together with TPM a hardware-based security and its set of attestation features, it can be used to perform authentication and to protect the IMA measurement.

Prerequisites

Hardware prerequisites:

• Raspberry Pi® 4 or Raspberry Pi® 3
• Use either of the following TPM2.0 boards:
  • IRIDIUM9670 TPM2.0
    
  • OPTIGA™ TPM SLB 9672 RPI evaluation board
    

Getting Started

In this repository, you will find attestation server and device (Raspberry Pi 3/4) reference implementations. For detailed setup and information, please find the Application Note at link.

License

This project is licensed under the MIT License - see the LICENSE file for details.

remote-attestation-optiga-tpm's Issues

One use "qualification"

Hello,
I found a problem related the the "qualification" (challenge).
It is not deleted in the "Attest" process in coreService.java therefore until the Raspberry-pi executes "4_atelic.sh" again, it cans relaunch "7_attest.sh" and be accepted.

I think it could be easily solved setting the qualification to null by the server (coreServer.java) in:

public Response<String> restAttest(@RequestBody Attest attest) {

when it is successfully imported:

`

        if (tpm.import_qualification(user.getQualification()) != true) {
            //We can delete the qualification to avoid futures replay attacks
            user.setQualification(null);
            userRepository.save(user);
            return new Response<String>(Response.STATUS_ERROR, "bad qualification format");
        }`

P.D.: I found useful this repository