imported>Oklopfer: substitute per MOS:SECTIONANCHOR

2026-06-29T18:42:02Z

imported>Citation bot: Added bibcode. Removed URL that duplicated identifier. Removed parameters. | Use this bot. Report bugs. | Suggested by Headbomb | Linked from Wikipedia:WikiProject_Academic_Journals/Journals_cited_by_Wikipedia/Sandbox | #UCB_webform_linked 748/967

2025-08-27T15:18:58Z

Added bibcode. Removed URL that duplicated identifier. Removed parameters. | Use this bot. Report bugs. | Suggested by Headbomb | Linked from Wikipedia:WikiProject_Academic_Journals/Journals_cited_by_Wikipedia/Sandbox | #UCB_webform_linked 748/967

← Previous revision		Revision as of 15:18, 27 August 2025
Line 16:		Line 16:
	# Sealed storage		# Sealed storage
	# Remote attestation		# Remote attestation
	# Trusted Third Party (TTP)		# [[Trusted third party\|Trusted Third Party]] (TTP)

	==={{anchor\|ENDORSEMENT-KEY}}Endorsement key===		==={{anchor\|ENDORSEMENT-KEY}}Endorsement key===
Line 30:		Line 30:

	==={{anchor\|REMOTE-ATTESTATION}}Remote attestation===<!-- This section is linked from [[Trusted Computing]] -->		==={{anchor\|REMOTE-ATTESTATION}}Remote attestation===<!-- This section is linked from [[Trusted Computing]] -->
	Remote attestation allows changes to the user's computer to be detected by authorized parties. For example, software companies can identify unauthorized changes to software, including users modifying their software to circumvent commercial digital rights restrictions. It works by having the hardware generate a certificate stating what software is currently running. The computer can then present this certificate to a remote party to show that unaltered software is currently executing. Numerous remote attestation schemes have been proposed for various computer architectures, including Intel,<ref>{{cite book \|last1=Johnson \|first1=Simon \|title=Intel Software Guard Extensions: EPID Provisioning and Attestation Services \|date=2016 \|publisher=Intel \|url=https://software.intel.com/content/dam/develop/public/us/en/documents/ww10-2016-sgx-provisioning-and-attestation-final.pdf \|access-date=14 May 2021}}</ref> RISC-V,<ref>{{cite conference \|last1=Shepherd \|first1=Carlton \|last2=Markantonakis \|first2=Konstantinos \|last3=Jaloyan \|first3=Georges-Axel\| title=LIRA-V: Lightweight Remote Attestation for Constrained RISC-V Devices \|date=2021 \|conference=IEEE Security and Privacy Workshops \|publisher=IEEE \|arxiv=2102.08804 }}</ref> and ARM.<ref>{{cite conference \|last1=Abera \|first1=Tigist \|title=C-FLAT: Control-Flow Attestation for Embedded Systems Software \|series=CCS '16 \|date=2016 \|pages=743–754 \|publisher=ACM \|doi=10.1145/2976749.2978358 \|isbn=9781450341394 \|s2cid=14663076 \|url=https://dl.acm.org/doi/abs/10.1145/2976749.2978358 \|access-date=14 May 2021\|url-access=subscription }}</ref>		Remote attestation allows changes to the user's computer to be detected by authorized parties. For example, software companies can identify unauthorized changes to software, including users modifying their software to circumvent commercial digital rights restrictions. It works by having the hardware generate a certificate stating what software is currently running. The computer can then present this certificate to a remote party to show that unaltered software is currently executing. Numerous remote attestation schemes have been proposed for various computer architectures, including Intel,<ref>{{cite book \|last1=Johnson \|first1=Simon \|title=Intel Software Guard Extensions: EPID Provisioning and Attestation Services \|date=2016 \|publisher=Intel \|url=https://software.intel.com/content/dam/develop/public/us/en/documents/ww10-2016-sgx-provisioning-and-attestation-final.pdf \|access-date=14 May 2021}}</ref> [[RISC-V]],<ref>{{cite conference \|last1=Shepherd \|first1=Carlton \|last2=Markantonakis \|first2=Konstantinos \|last3=Jaloyan \|first3=Georges-Axel\| title=LIRA-V: Lightweight Remote Attestation for Constrained RISC-V Devices \|date=2021 \|conference=IEEE Security and Privacy Workshops \|publisher=IEEE \|arxiv=2102.08804 }}</ref> and ARM.<ref>{{cite conference \|last1=Abera \|first1=Tigist \|title=C-FLAT: Control-Flow Attestation for Embedded Systems Software \|series=CCS '16 \|date=2016 \|pages=743–754 \|publisher=ACM \|doi=10.1145/2976749.2978358 \|isbn=9781450341394 \|s2cid=14663076 \|url=https://dl.acm.org/doi/abs/10.1145/2976749.2978358 \|access-date=14 May 2021\|url-access=subscription }}</ref>

	Remote attestation is usually combined with public-key encryption so that the information sent can only be read by the programs that requested the attestation, and not by an eavesdropper.		Remote attestation is usually combined with public-key encryption so that the information sent can only be read by the programs that requested the attestation, and not by an eavesdropper.
Line 103:		Line 103:
	While proponents of TC point out that online purchases and credit transactions could potentially be more secure as a result of the remote attestation capability, this may cause the computer user to lose expectations of anonymity when using the Internet.		While proponents of TC point out that online purchases and credit transactions could potentially be more secure as a result of the remote attestation capability, this may cause the computer user to lose expectations of anonymity when using the Internet.

	Critics point out that this could have a chilling effect on political free speech, the ability of journalists to use anonymous sources, whistle blowing, political blogging and other areas where the public needs protection from retaliation through anonymity.		Critics point out that this could have a [[chilling effect]] on political free speech, the ability of journalists to use anonymous sources, whistle blowing, political blogging and other areas where the public needs protection from retaliation through anonymity.

	The TPM specification offers features and suggested implementations that are meant to address the anonymity requirement. By using a third-party Privacy Certification Authority (PCA), the information that identifies the computer could be held by a trusted third party. Additionally, the use of [[direct anonymous attestation]] (DAA), introduced in TPM v1.2, allows a client to perform attestation while not revealing any personally identifiable or machine information.		The TPM specification offers features and suggested implementations that are meant to address the anonymity requirement. By using a third-party Privacy Certification Authority (PCA), the information that identifies the computer could be held by a trusted third party. Additionally, the use of [[direct anonymous attestation]] (DAA), introduced in TPM v1.2, allows a client to perform attestation while not revealing any personally identifiable or machine information.
Line 110:		Line 110:

	===TCG specification interoperability problems===		===TCG specification interoperability problems===
	Trusted Computing requests that all software and hardware vendors will follow the technical specifications released by the [[Trusted Computing Group]] in order to allow interoperability between different trusted software stacks. However, since at least mid-2006, there have been interoperability problems between the TrouSerS trusted software stack (released as open source software by [[IBM]]) and [[Hewlett-Packard]]'s stack.<ref>{{cite web \| work = TrouSerS FAQ \| url = ~~http~~://trousers.sourceforge.net/faq.html#1.7 \| title = 1.7 - I've taken ownership of my TPM under another OS... \| access-date = 2007-02-07 }}</ref> Another problem is that the technical specifications are still changing, so it is unclear which is the standard implementation of the trusted stack.		Trusted Computing requests that all software and hardware vendors will follow the technical specifications released by the [[Trusted Computing Group]] in order to allow interoperability between different trusted software stacks. However, since at least mid-2006, there have been interoperability problems between the TrouSerS trusted software stack (released as open source software by [[IBM]]) and [[Hewlett-Packard]]'s stack.<ref>{{cite web \| work = TrouSerS FAQ \| url = https://trousers.sourceforge.net/faq.html#1.7 \| title = 1.7 - I've taken ownership of my TPM under another OS... \| access-date = 2007-02-07 }}</ref> Another problem is that the technical specifications are still changing, so it is unclear which is the standard implementation of the trusted stack.

	===Shutting out of competing products===		===Shutting out of competing products===
	People have voiced concerns that trusted computing could be used to keep or discourage users from running software created by companies outside of a small industry group. [[Microsoft]] has received a great deal{{vague\|date=March 2015}} of bad press surrounding their [[NGSCB\|Palladium]] software architecture, evoking comments such as "Few pieces of vaporware have evoked a higher level of fear and uncertainty than Microsoft's Palladium", "Palladium is a plot to take over cyberspace", and "Palladium will keep us from running any software not personally approved by Bill Gates".<ref>{{cite journal \|last1=Felten \|first1=E.W. \|title=Understanding trusted computing: will its benefits outweigh its drawbacks? \|journal=[[IEEE Security & Privacy]] \|date=May 2003 \|volume=1 \|issue=3 \|pages=60–62 \|doi=10.1109/MSECP.2003.1203224}}</ref> The concerns about trusted computing being used to shut out competition exist within a broader framework of consumers being concerned about using [[Product bundling\|bundling]] of products to obscure prices of products and to engage in [[anti-competitive practices]].<ref name="anderson2"/> Trusted Computing is seen as harmful or problematic to independent and [[Open-source software\|open source]] software developers.<ref>{{Cite journal~~\|url=https://ieeexplore.ieee.org/document/1423956~~ \|doi=10.1109/MSP.2005.40 \|s2cid=688158 \|title=Does Trusted Computing Remedy Computer Security Problems? \|date=2005 \|last1=Oppliger \|first1=R. \|last2=Rytz \|first2=R. \|journal=IEEE Security ~~and~~ Privacy ~~Magazine~~ \|volume=3 \|issue=2 \|pages=16–19 \|~~url-access~~=~~subscription~~ }}</ref>		People have voiced concerns that trusted computing could be used to keep or discourage users from running software created by companies outside of a small industry group. [[Microsoft]] has received a great deal{{vague\|date=March 2015}} of bad press surrounding their [[NGSCB\|Palladium]] software architecture, evoking comments such as "Few pieces of vaporware have evoked a higher level of fear and uncertainty than Microsoft's Palladium", "Palladium is a plot to take over cyberspace", and "Palladium will keep us from running any software not personally approved by Bill Gates".<ref>{{cite journal \|last1=Felten \|first1=E.W. \|title=Understanding trusted computing: will its benefits outweigh its drawbacks? \|journal=[[IEEE Security & Privacy]] \|date=May 2003 \|volume=1 \|issue=3 \|pages=60–62 \|doi=10.1109/MSECP.2003.1203224 \|bibcode=2003ISPri..99c..60F }}</ref> The concerns about trusted computing being used to shut out competition exist within a broader framework of consumers being concerned about using [[Product bundling\|bundling]] of products to obscure prices of products and to engage in [[anti-competitive practices]].<ref name="anderson2"/> Trusted Computing is seen as harmful or problematic to independent and [[Open-source software\|open source]] software developers.<ref>{{Cite journal\|doi=10.1109/MSP.2005.40 \|s2cid=688158 \|title=Does Trusted Computing Remedy Computer Security Problems? \|date=2005 \|last1=Oppliger \|first1=R. \|last2=Rytz \|first2=R. \|journal=IEEE Security & Privacy \|volume=3 \|issue=2 \|pages=16–19 \|bibcode=2005ISPri...3b..16O }}</ref>

	===Trust===		===Trust===
Line 126:		Line 126:
	Since 2004, most major manufacturers have shipped systems that have included [[Trusted Platform Module]]s, with associated [[BIOS]] support.<ref name="tpmvendors">{{cite web \| url = http://www.tonymcfadden.net/tpmvendors_arc.html \| title = TPM Matrix \| author = Tony McFadden \| date = March 26, 2006 \| access-date = 2006-05-05 \| url-status = dead \| archive-url = https://web.archive.org/web/20070426034219/http://www.tonymcfadden.net/tpmvendors_arc.html \| archive-date = April 26, 2007 }}</ref> In accordance with the TCG specifications, the user must enable the Trusted Platform Module before it can be used.		Since 2004, most major manufacturers have shipped systems that have included [[Trusted Platform Module]]s, with associated [[BIOS]] support.<ref name="tpmvendors">{{cite web \| url = http://www.tonymcfadden.net/tpmvendors_arc.html \| title = TPM Matrix \| author = Tony McFadden \| date = March 26, 2006 \| access-date = 2006-05-05 \| url-status = dead \| archive-url = https://web.archive.org/web/20070426034219/http://www.tonymcfadden.net/tpmvendors_arc.html \| archive-date = April 26, 2007 }}</ref> In accordance with the TCG specifications, the user must enable the Trusted Platform Module before it can be used.

	~~The~~ [[~~Linux kernel~~]] ~~has included trusted computing support since version 2.6.13~~, and ~~there are several projects to implement trusted computing for Linux. In January 2005, members of~~ [[~~Gentoo Linux~~]]~~'s "crypto herd" announced their intention of providing support for TC—in particular support for the Trusted Platform Module~~.<ref ~~name="lwntc"~~>{{~~cite~~ web \| url=https://~~lwn~~.~~net~~/~~Articles~~/~~121386~~/ ~~\| title = Trusted Gentoo \| date = January 31, 2005~~ \| access-date=~~2006~~-05-05 \| ~~work~~ = ~~Gentoo Weekly Newsletter~~ }}</ref> There is also a TCG-compliant software stack for Linux named [http://trousers.sourceforge.net/ TrouSerS], released under an open source license. There are several open-source projects that facilitate the use of confidential computing technology, including [https://github.com/edgelesssys/ego EGo], EdgelessDB and MarbleRun from [[Edgeless Systems]], as well as Enarx, which originates from security research at [[Red Hat]].		Processor manufacturers have included secure enclaves in their design such as [[ARM TrustZone]], [[Intel Management Engine]] with [[Software Guard Extensions\|SGX]] and [[AMD PSP]] with [[Secure Encrypted Virtualization]].<ref>{{Cite web\|date=2021-07-08\|title=Cryptography and privacy: protecting private data\|url=https://www.ericsson.com/en/blog/2021/7/cryptography-and-privacy-protecting-private-data\|access-date=2022-02-09\|website=www.ericsson.com\|language=en}}</ref>

	Some limited form of trusted computing can be implemented on current versions of [[Microsoft Windows]] with third-party software. Major cloud providers such as [[Microsoft Azure]],<ref>{{Cite web \|title=Azure Confidential Computing – Protect Data-In-Use {{!}} Microsoft Azure \|url=https://azure.microsoft.com/en-us/solutions/confidential-compute/ \|access-date=2022-02-09 \|website=azure.microsoft.com \|language=en}}</ref> [[Amazon Web Services\|AWS]]<ref>{{Cite web \|title=What is AWS Nitro Enclaves? - AWS \|url=https://docs.aws.amazon.com/enclaves/latest/user/nitro-enclave.html \|access-date=2022-02-09 \|website=docs.aws.amazon.com}}</ref> and [[Google Cloud Platform]]<ref>{{Cite web \|title=Confidential Computing \|url=https://cloud.google.com/confidential-computing \|access-date=2022-02-09 \|website=Google Cloud \|language=en}}</ref> have virtual machines with trusted computing features available. With the [[Intel]] [[Software Guard Extensions\|Software Guard Extension]] (SGX) and [[Advanced Micro Devices\|AMD]] [[Secure Encrypted Virtualization]] (SEV) processors, there is hardware available for runtime memory encryption and remote attestation features.<ref>{{Cite web\|date=2021-07-08\|title=Cryptography and privacy: protecting private data\|url=https://www.ericsson.com/en/blog/2021/7/cryptography-and-privacy-protecting-private-data\|access-date=2022-02-09\|website=www.ericsson.com\|language=en}}</ref>		The [[Linux kernel]] has included trusted computing support since version 2.6.13, and there are several projects to implement trusted computing for Linux. In January 2005, members of [[Gentoo Linux]]'s "crypto herd" announced their intention of providing support for TC—in particular support for the Trusted Platform Module.<ref name="lwntc">{{cite web \| url=https://lwn.net/Articles/121386/ \| title = Trusted Gentoo \| date = January 31, 2005 \| access-date=2006-05-05 \| work = Gentoo Weekly Newsletter }}</ref> There is also a TCG-compliant software stack for Linux named [https://trousers.sourceforge.net/ TrouSerS], released under an open source license. There are several open-source projects that facilitate the use of confidential computing technology, including [https://github.com/edgelesssys/ego EGo], EdgelessDB and MarbleRun from [[Edgeless Systems]], as well as Enarx, which originates from security research at [[Red Hat]].

			Some limited form of trusted computing can be implemented on current versions of [[Microsoft Windows]] with third-party software. Major cloud providers such as [[Microsoft Azure]],<ref>{{Cite web \|title=Azure Confidential Computing – Protect Data-In-Use {{!}} Microsoft Azure \|url=https://azure.microsoft.com/en-us/solutions/confidential-compute/ \|access-date=2022-02-09 \|website=azure.microsoft.com \|language=en}}</ref> [[Amazon Web Services\|AWS]]<ref>{{Cite web \|title=What is AWS Nitro Enclaves? - AWS \|url=https://docs.aws.amazon.com/enclaves/latest/user/nitro-enclave.html \|access-date=2022-02-09 \|website=docs.aws.amazon.com}}</ref> and [[Google Cloud Platform]]<ref>{{Cite web \|title=Confidential Computing \|url=https://cloud.google.com/confidential-computing \|access-date=2022-02-09 \|website=Google Cloud \|language=en}}</ref> have virtual machines with trusted computing features available.

	The Intel [[Classmate PC]] (a competitor to the [[One Laptop Per Child]]) includes a Trusted Platform Module.<ref name="classmatepc">{{cite web \| url=http://download.intel.com/intel/worldahead/pdf/classmatepc_productbrief.pdf?iid=worldahead+ac_cmpc_pdf \| title = Product Brief: Classmate PC \| author = Intel \| date = December 6, 2006 \| access-date = 2007-01-13 }}</ref>		The Intel [[Classmate PC]] (a competitor to the [[One Laptop Per Child]]) includes a Trusted Platform Module.<ref name="classmatepc">{{cite web \| url=http://download.intel.com/intel/worldahead/pdf/classmatepc_productbrief.pdf?iid=worldahead+ac_cmpc_pdf \| title = Product Brief: Classmate PC \| author = Intel \| date = December 6, 2006 \| access-date = 2007-01-13 }}</ref>

	[[PrivateCore]] vCage software can be used to attest [[x86]] servers with TPM chips.		[[PrivateCore]] vCage software can be used to attest [[x86]] servers with TPM chips.

			Google enforces [[Play Integrity API]] to Android devices with their bootloader unlocked.

	Mobile T6 secure operating system simulates the TPM functionality in mobile devices using the [[ARM TrustZone]] technology.<ref>{{cite web\|url=http://www.trustkernel.org\|title=T6: TrustZone Based Trusted Kernel\|access-date=2015-01-12}}</ref>		Mobile T6 secure operating system simulates the TPM functionality in mobile devices using the [[ARM TrustZone]] technology.<ref>{{cite web\|url=http://www.trustkernel.org\|title=T6: TrustZone Based Trusted Kernel\|access-date=2015-01-12}}</ref>

imported>OAbot: Open access bot: url-access updated in citation with #oabot.

2025-05-24T20:36:26Z

Open access bot: url-access updated in citation with #oabot.

Show changes

Trusted Computing - Revision history

imported>Oklopfer: substitute per MOS:SECTIONANCHOR

imported>Citation bot: Added bibcode. Removed URL that duplicated identifier. Removed parameters. | Use this bot. Report bugs. | Suggested by Headbomb | Linked from Wikipedia:WikiProject_Academic_Journals/Journals_cited_by_Wikipedia/Sandbox | #UCB_webform_linked 748/967

imported>OAbot: Open access bot: url-access updated in citation with #oabot.