The Trusted Computing Group is a collection of 55 vendors including HP, Intel and Microsoft that formed a year ago to develop specifications for chip-based security. Nancy Sumrall, marketing chair for the group and manager of the safer computing initiative within Intel’s desktop platforms group, recently gave Network World Senior Editor Ellen Messmer an update on the TCG.
The Trusted Computing Group is a collection of 55 vendors including HP, Intel and Microsoft that formed a year ago to develop specifications for chip-based security. Nancy Sumrall, marketing chair for the group and manager of the safer computing initiative within Intel’s desktop platforms group, recently gave Network World Senior Editor Ellen Messmer an update on the TCG.
What was the impetus for forming the Trusted Computing Group?
Prior to April of last year, the group had loosely gotten together. Intel, Microsoft, HP and IBM started working on a specification for a trusted platform module [TPM]. As more companies wanted to be involved, we incorporated as a nonprofit, industry standards body worldwide.
What is a TPM?
It’s a chip on the motherboard, a microcontroller that allows you to have secure operations for encrypted e-mail, digital signatures, file and folder encryption, platform authentication and storage. It stores the private keys for the encryption. The TPM is a discrete component, and it’s manufactured by Atmel, National Semiconductor, Infineon and, most recently, Renaissance.
What’s TPM’s status?
The first specification was adopted from the work of the loosely held organization. It’s TPM 1.1b, a revision to earlier work out since September 2001. The TPM 1.2 spec released last November fixed some of the problems in 1.1b and added new features. Among new features, there was one added for what’s called “direct anonymous attestation.”
What is direct anonymous attestation?
It’s a way of internally – through mathematical calculations – being able to provide certificates and credentials. Certificate usage hasn’t really taken off in the industry due to the cost, so this is an alternative way to do it. An IT department can ‘trust’ without the use of a trusted third party. It was developed by Intel and HP.
Are the Microsoft crypto APIs used with the TPM?
The TPM can utilize Microsoft [CryptoAPI] or PKCS #11 or the TCG software stack, a standard you can write to as well. Many software application vendors, such as Wave Systems, are using that.
What’s the significance of supporting trusted computing technology in hardware?
Software alone may not be the proper solution for security or preventing viruses or attacks. . . . The TPM is soldered down to the motherboard so if anyone tries to pry that off everything gets erased. You can’t pry that TPM off and put it on another platform and know someone else’s key.
Does the TPM use specific key lengths?
It’s 2,048-bit based on Advanced Encryption Standard and SHA-1. IBM has its ThinkPad series, RXT, where TPM is an option on the motherboard. It’s also an opt-in device, which means you have to turn it on. HP has also come out with a desktop that includes TPM. Fujitsu just announced its Lifebook, and Intel has a motherboard we sell with the TPM. So right now the current applications are the desktop and mobile. You can do encrypted e-mail and send it to someone who also may have TPM and they can decrypt that.
What constitutes conformance to the specs?
There’s functionality testing for 1.1 and 1.2, which is easy, and TCG has also worked on a set of protection profiles which are published. When manufacturers make a PC, they know they have to conform to these profiles. We have a conformance workgroup and test labs, and we’re working on these issues. You can buy 1.1 products and use them until the 1.2s are available. It’s backward-compatible.
What role, if any, does Microsoft play here?
At TCG, we write building blocks. With my Intel hat on, we have a product that we talk about in our latest Intel Developer Forum called LaGrand that utilizes the TPM. It allows you to do protected execution in a secure spot on the processor. Microsoft has its secure operating system. So you’ll have the secure TPM, software that’s written by application vendors that adhere to the TCG software stack or CAPI or PKCS #11. Microsoft has its own initiative, Next-Generation Secure Computing Base. All of this will work together.
What’s next for the group?
All the TPM vendors are working on their prototypes now. Atmel said its TPM 1.2 hardware would be available in the April timeframe. We’ve been talking about things that are PC-centric, but we have many new workgroups: storage, server, peripherals and mobile devices. We’re looking at putting TPM in cell phones. We also have our infrastructure workgroup looking at different usage cases, such as VoIP.
