ROCA: Infineon TPM and Secure Element RSA Vulnerability Guidance

This page contains guidance for people who want to understand and reduce the impact of the vulnerability known as ROCA (Return of Coppersmith’s Attack). The vulnerability is in Trusted Platform Modules (TPMs) and Secure Elements (SEs) produced by Infineon Technologies AG.

ROCA was first reported publicly by Microsoft on 10 October. The researchers who discovered the vulnerability first published initial details of their findings on 16 October 2017.

• Enterprise Windows users are likely to be affected by this vulnerability and, where this is the case, action will need to be taken.
• Home users of Windows are unlikely to be vulnerable.

A flaw has been discovered in a software library used by Infineon TPMs and SEs to generate RSA private keys. The consequence of this flaw is that it takes significantly less work than previously thought to determine an RSA private key from its public counterpart. This makes attacks feasible against data and services protected by those keys.

In devices affected by the vulnerability, the researchers estimated that the cost of breaking an individual 2048-bit RSA key to be around $20,000 (and an individual 1024-bit RSA key $40). This means that targeted attacks against individual keys may now be worthwhile for a variety of threat actors against a variety of targets.

The flaw is not known to affect other types of keys generated by Infineon TPMs and SEs.

Trusted Platform Modules (TPMs) and Secure Elements (SEs) are present in a huge variety of devices, and they're used in a multitude of ways by both operating systems and third-party software. So, unfortunately, this makes it impossible to give fully comprehensive guidance here.

Trusted Platform Modules are primarily found in enterprise client PCs, but can also be found in servers, some consumer client PCs and most Chrome OS devices. They have made their way into a variety of embedded applications. They are dedicated security components which provide a secure environment in which to perform cryptographic operations.

They are used to protect data when mobile devices are lost, and for storage and processing of keys that may be used in features such as:

• authentication (of devices and users)
• email encryption with S/MIME and PGP
• Virtual Private Networks
• TLS and SSH connections
• certificate authorities
• software signing

Secure elements are secure storage and processing areas in embedded devices such as smart cards, security tokens, and some mobile devices. Like TPMs on PCs, they provide a secure environment in which to perform cryptographic operations. They, too, enable a variety of similar use cases to TPMs.

To determine if you're affected, you must find out:

• whether you have a device containing an affected TPM or Secure Element
• whether the TPM or Secure Element has a vulnerable firmware version
• whether you are using features that have been configured to use RSA Key Generation in the vulnerable TPM or Secure Element

To date, we are aware that Microsoft, Google (Chrome OS), Yubico, Gemalto and a number of PC vendors have made public announcements about the impact to their products. Over the coming weeks we expect further device and software vendors to make announcements. Users should remain vigilant for further advisories from vendors. We will be updating this page with details if/when more information becomes available.

• Users of Windows operating systems should consult Microsoft’s guidance
• Users of Chrome OS should consult Google’s guidance
• Users of Yubikey devices should consult Yubico’s guidance
• Users of Gemalto IDPrime.Net products should consult Gemalto's guidance

If your device or software is not listed here and you are still concerned, you should contact your vendor or reseller.

Finally, if you're not otherwise able to find out if your device(s) are affected, the researchers who discovered the vulnerability have made tests available which allow you to determine whether your RSA public keys are vulnerable.

Again, due to the huge variety of use cases it is impossible to give comprehensive guidance here, but we have summarised issues on some of the major affected platforms.

Windows end user devices

The NCSC end user device security guidance for Windows makes use of TPMs for several features, so if you have a vulnerable device and are following NCSC guidance then you will need to take remedial action. The following features are affected and will have significantly weakened security as a result:

• BitLocker (when used with TPM 1.2)
• Credential Guard/DPAPI/Windows Information Protection
• Device Health Attestation Service (DHA)
• Virtual Smart Card (VSC)
• Windows Hello For Business and Azure Active Directory
• Windows Hello (and Microsoft Accounts (MSA))

For full details on the impact of the vulnerability on each of these features, see https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV170012 . Home users of Windows are unlikely to be vulnerable as the only feature they will likely be using the TPM for is Device Encryption on Windows 8 and above, which doesn't rely on RSA keys generated by the TPM.

Windows servers

The following Windows Server features are affected when in use on hardware with an affected TPM.

• Active Directory Certificate Services (ADCS)
• Active Directory Directory Services (ADDS)
• Windows Server 2016 Domain-joined device public key authentication

For full details on the impact of the vulnerability on each of these features, see https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV170012

Chrome OS devices

Chrome OS devices are affected in their default configuration. The following security features are vulnerable:

• User data encryption
• Network authentication using certificates to services such as WPA2-EAP and, HTTPS.
• Chrome OS Verified Access

For full details on which Chrome OS features are affected, see https://sites.google.com/a/chromium.org/dev/chromium-os/tpm_firmware_update. You can check for certificates backed by TPM at chrome://settings/certificates

Embedded devices, smart cards and third-party security software

Contact your device manufacturer or software vendor for full details of the impact of this vulnerability.

Due to the complexity of this issue we recommend:

1. Prioritise high impact services, such as public-facing network services, Certificate Authorities, Hardware Security Modules, VPNs, and software signing.
2. Follow manufacturer guidance to investigate devices to see if they are vulnerable.
3. Install updates to fix the underlying issue, if available.
4. Take remedial action as advised by the manufacturer and/or software vendor to replace keys that were generated using the vulnerable component.
   

Note that whilst you may have a large number of affected devices, you may be able to manage the risk of not patching all of them immediately. For example, to break an RSA key protecting BitLocker, an attacker still needs physical access, and must spend an expected cost of $20,000 per device (for 2048 bit keys) to break the key. Although this sum may decrease over time (as the cost of computation decreases or if new research makes the attack cheaper) you might, in the meantime, decide to begin a gradual process of remediation rather than recalling devices immediately.

In this case it is not sufficient to simply install updates.

For many of the resolutions to the ROCA issue, manual steps must be taken to revoke weak keys, and regenerate strong keys. Where updates are unavailable for the hardware or firmware, software replacements may provide a more secure alternative.

For example, devices using BitLocker with TPM or TPM+PIN as protectors will need to reapply those protectors (although they will not need to fully decrypt and re-encrypt the disk). Details of the remedial action required can be found at the websites of the following vendors:

• Microsoft: https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV170012
• Google: https://sites.google.com/a/chromium.org/dev/chromium-os/tpm_firmware_update

Firmware updates for affected devices can be obtained from the device OEM. Links can be found in the following section.

For more information on this vulnerability please see the following resources:

• Initial details of the attack have been published by the researchers who discovered the vulnerability. Full details will be released on 2 November 2017.
• Infineon has published some details of the flaw and their response to the vulnerability.
• Google has published details of affected Chrome OS devices, affected Chrome OS features, plus how to remediate the vulnerability.
• Microsoft has published details of affected Windows versions and features, how to identify affected Windows devices, how to remediate the flaw, and links to information provided by affected Windows device manufacturers.
• Yubico has published details of affected Yubico products, affected features, and mitigation and remediation steps.
• Gemalto has published details of affected Gemalto products.

PC vendors have provided details of devices that include vulnerable Infineon TPMs, and how to update them:

• Acer
• Fujitsu
• HP
• HP Enterprise
• Lenovo
• Toshiba

You may also want to read:

• The NCSC blog on automating firmware updates in an enterprise
• NCSC guidance on managing EUDs including Windows 10 and Chrome OS devices