How should we then store the key how to generate the keys.
There are two problems.
The first problem is randomness and the second is the secure storage of keys when speaking of TPM modules.
Let's imagine them as smart cards.
Why are smart cards called Smart What tasks do smart cards fulfill the store the key.
However the key can safely be stored on a floppy disk or a flash drive.
Smart cards which simply store keys are certainly not smart.
These are definitely dumb cards.
You can also buy them and in the past we're extremely popular since they were fairly cheap.
The intelligence of the cards depends on the fact that they not only store the key but also protected
by not making it available on the outside.
This card is to generate that key otherwise it would have to download it from the outside which it shouldn't
do.
In addition to this it must also carry out operations using this key for example decrypt data.
It does this so that the key would never have to be made available on the outside if it fulfills these
conditions.
We can say that it is a smart card.
The problem is however that this is quite simple and it should be a fairly cheap device.
To ecard may try to physically get the data or destroy it.
These types of attacks are confirmed and have occurred many times.
Bearing in mind what we said about smartcards.
Let's look at the TPM module TPM modules example seen above where standard equipment and most likely
all contemporary portable computers and servers.
The task of the TPM modules is implementing certain algorithms.
There are different algorithms according to the manufacturer and type of module.
In addition these modules generate and safely store keys defacto do the same as smartcards but we did
not connect them to the computer from the outside because they're soldered to the board.
They're relatively safe they're of course you can try to remove the housing of the TPM module and connect
a probe directly to its modules conducting an analysis of performance time and power.
The TPM module and bit Locker's not used only to generate and store keys but also to verify the integrity
of the computer.
The point is that the TPM module calculates the signature of the computer's process registers.
The first thing the computer launches is the old biosystem this system saves certain information and
storage registers.
Well take a look at that in the moment.
The TPM module reads this information it compares its hash to the hash that was previously saved.
This means that a change to the integrity of the computer for example a connection to a new hard disk
or even a connection to a USP drive will cause that the integrity of the computer will not be confirmed
the checksum will not agree.
This means for the TPM module that the bit lock keys stored on it is to be blocked and not made available
to the outside.
Let's take a look then at which storage registers are used by bit longer registers 4 8 9 10 and 11 are
used by default.
We can also ask for an additional check of the runtime registers we can for example check the raw memory
register then risk that in the event to any changes of the memory.
The checksum will not agree.
We can also check the runtime register connected with the biosystem This in turn would cause a situation
that when we want to update the biosystem we would first have to turn off the bit lock or encryption.
If we do not we don't encrypt the disk.
We have some information which clearly confirms the authenticity and integrity of the computer it checks
whether or not it's the same computer.
If it's trying to run it from a CD or a USP drive if someone is not connected a disk drive to it or
whether someone has taken out a disk and connected it to another computer.
As we mentioned this information is vital to make a decision on whether or not the keys stored in the
TPM module will be decrypted.
Let's now look at the keys in their hierarchy.
We already know that encryption consists of encrypting individual disk sectors.
The ABS algorithm operating in CBC mode.
This is a mode in which the encryption key to the next sector is derived from the previous encrypted
sector.
Encrypted data are diffused by elephant.
Let's go to keys now.
We have this storage route key.
It's called as r.k it's safely stored in the TPM module.
The volume master key DMK is encrypted using as r.k the VM caky pre-text bit Locker's full volume encryption
key as Jack.
The point is that we need to be able to change the key without having to decrypt the entire disk with
the old key and re-encrypt it with the new key
for such a solution to be possible.
There must be an intermediate element we'll be able to decrypt with an intermediate key and encrypt
with the new key.
This however will continue to be the same intermediate key which will decrypt the entire disk.
Enabling and disabling bit longer can be done very fast regardless of how the disk is protected.
Additionally a copy of the VM KCi is password protected which we must provide an enabling bit locker.
If something terrible happened to our TPM module we need to be able to return to our data at this point.
We can open the VM cakey with a password which we have saved or printed
the VM cakey can additionally be protected by a smartcard.
Then you need to connect it when turning on your computer.
Protection of the VM may also be a combination of all these modes.
The most commonly used mode though is the TPM module in this mode.
The mechanism of action is as follows.
The biosystem records the values of the PCR registers.
It does this every time it's run
based on selected PCR registers the SRK kids generated if the cake is valid if the checksum was correct
it allows decrypting of the volume master key.
In turn this key decrypts the key already saved on the disk.
The ethic key is the primary key which allows decrypting other disk sectors.