WIXLIB

4. Roles, Authentication and ServicesThe two operation roles implemented by the Module are summarized in the table below.Table 8. RolesRoleAc ronymHigh Level DescriptionCrypto -Off icerCOAlso known as “Object Administrator”; installs andconf igures the Module , controls certif ication, chang esauthorizationObject UserOUUses the object to e xecutes servicesDuplicateDUPDuplicates an object (if object duplication is allowed)The Module provides three authorization types to identify the role: Password, HMAC andPolicy.Password Authorization - A plaintext password value presented to authorize an action oridentify a role. A plaintext password may be only appropriate for cases in which the pathbetween the caller and the TPM is trusted or when the password is well known.HMAC Authorization – Proving the knowledge of a shared secret via challenge-responseHMAC protocol to authorize an action or identify a role. HMAC key is the shared secret.Policy Authorization – Also known as “Enhanced Authorization”, allows entity-creators oradministrators to require specific tests or actions to be performed as authorization method oridentity proof. The specific policy is encapsulated in a digest value that is associated with anentity. An entity has a policy that defines the conditions for use of an entity. A policy may bearbitrarily complex. However, the policy is expressed as one (statistically unique) digest calledthe authPolicy.Both HMAC and Policy authorizations include rolling nonce values as part of the protocol, asa challenge and to prevent a replay-attack.Note: For commands that require Platform Authorization and commands that require ahierarchy authorization, it is possible to require an additional out-of-band authorization.This may use a dedicated pin in the TPM – also known as “Physical Presence” (PP).The TPM maintains a table of the commands that require that PP be asserted toauthorize command execution. Only certain commands may be included in this table.NPCT7xx TPM 2.014FIPS 140-2 Security Policy

4.1 Authentication4.1.1 Dictionary Attack (DA) ProtectionThe TPM incorporates mechanisms that provide protection against guessing or exhaustivesearches of authorization values stored within the TPM.The DA protection logic is triggered when the rate of authorization failures is too high. If thisoccurs, the TPM enters Lockout mode preventing any operation that requires use of a DAprotected object. Depending on the settings of the configurable parameters, the TPM can“self-heal” after a specified amount of time or be programmatically reset using proof ofknowledge of an authorization value or satisfaction of a policy (i.e., using lockoutAuth).While authorization values that are expected to be high-entropy values will not need DAprotection, lockoutAuth is always DA-protected even though it may have high-entropy.4.1.2 Authorization StrengthThe Module authenticates operator actions using authorization tokens. Consider mostconservative TPM command throughput on the bus and command execution duration, wouldallow 1,000 commands per second or 60,000 attempts per minute.Password and HMAC Authorization StrengthWhen a high-entropy authorization token is used (where DA protection may be disabled), eachvalue, statistically, has the same probability to be chosen. For worst case scenario, assumeSHA-1 output values size (160 bit array), producing 2160 different possible values.Probability for randomly successful attempt is 2 -160, assuming 60,000 trials per minute wouldproduce probability for success in one minute: 2 -160 60,000 4.1 10-44 10-5.If a lower entropy authorization token is used (e.g., memorized PIN or password), acombination of password size (i.e., determines size of entropy) and DA protection settingshould be selected to meet the FIPS requirements. The requirement of an eight-characterpassword string with TCG’s default DA settings (maxTries 3; recoveryTime 1,000seconds) would produce the necessary strength. For the worst case, assume an eight-digitPIN, allowing 108 different possible values with equal probability. The TCG default DAsettings listed above would allow three trials before lockout (for duration of over a minute).The probability for a randomly successful attempt is 10-8, assuming 3 trials would produce theprobability for success in less than one minute: 10-8 3 3 10-8 10-5.Policy Authorization StrengthSince policy authorization is expressed as (statistically unique) digest, for worst casescenario, assume SHA-1 output values size (160 bit array), producing 2 160 different possiblevalues.Probability for randomly successful attempt is 2 -160, assuming 60,000 trials per minute wouldproduce probability for success in one minute: 2 -160 60,000 4.1 10-44 10-5.NPCT7xx TPM 2.015FIPS 140-2 Security Policy

4.1.3 Authorization Token Value SelectionTPM permits the creation of objects with NULL authorization (empty buffer). However, to meetthe Authorization Strength listed in Section 4.1.2, roles should not use NULL authorizationvalues for CSPs.The TPM Crypto-Officer’s role is to set proper authorization values for the Storage andEndorsement hierarchies (if there is no OS managing these authorization values for the user).4.2 ServicesTable 9 lists all Module services, the affected CSPs, and the associated roles:Table 9. Module ServicesServiceGet StatusDescriptionThe Module implements a GetStatus commands that returns thestatus of the Module, includingsuccess or f ailure of s elf tests.CSPRoleNoneCO,OU,DUPNoneCO,OU,DUPNote: This service (e.g.,TPM2 GetCapability) does not requireauthenticationSelf TestsThe Module runs power -on selftests automatically when poweredon and on demand.Note: This service (e.g.,TPM2 Selftest) does not requireauthenticationEncryptUsed to encrypt dataEncryption keys ,Public storage keys ,Platform keysCO,OU,DUPDecryptUsed to decrypt dataEncryptio n keys,Private storage keys,Endorsement keys,Platform keysCO,OUNPCT7xx TPM 2.016FIPS 140-2 Security Policy

ServiceDescriptionCSPRoleZeroizeUsed to zeroize (irreversiblydestroy) Module's cryptographickeys and CSPsEncryption keys,COPublic verif ication keys,Public storage keys,Private storage keys,Identity keys,H MAC keys,DRBG seeds,Endorsement keys,Platform keysMAC,MAC Verif yUsed to calculate and verif y MACf or dataH MAC keysKeyGenerateUsed to generate keysEncryption keys,CO,Public verif ication keys, OUPublic storage keys,Private storage keys,Identity keys,Ephemeral keys,H MAC keys,DRBG seeds,Endorsement keys ,Platform keysRSA Verif yUsed to verif y data using RSAPublic verif ication keys , CO,Platform keys,OUFirm ware Update keyRSA SignUsed to sign data using RSAIdentity keys ,Platform keysECDSAVerif yUsed to verif y data using ECDSAPublic verif ication keys , CO,Platform keysOUECDSA SignUsed to sign data using ECDSAIdentity keys ,Platform keysKey ImportUsed to import keysEncryption keys,COPublic verif ication keys,Public storage keys,Private storage keys ,Identity keys ,H MAC keys,Platform keysNPCT7xx TPM 2.017CO,OUCO,OUCO,OUFIPS 140-2 Security Policy

ServiceDescriptionCSPRoleKeyDuplicateUsed to export keysEncryption keys,Public storage keys ,Private storage keys ,Ephemeral keys,H MAC keys,Platform keysCO,DUPKeyAgreementUsed to derive a keyEphemeral Keys,Endorsement keys,Platform keysCO,OUTPM IdentityUsed to authenticate TPM Identityto other partiesIdentity keysCO,OUTPMUsed to prove to other parties thatEndorsement TPM i s a genuine TPMEndorsement keysCO,OUTPM GetRandomDRBG seedsCO,OUDRBG seedsCO,OUUsed to generate random dataNote: This service does not requireauthentication .TPM Sti rRandomUsed to add entropy to the randombit generatorNote: This service does not requireauthentication .InstallModuleInstalls ModuleH MAC keys,Platform keysCOFirm wareUpdateUpdates Module’s f irmware.Requires Platf orm Authorization.Firm ware Update keyCONPCT7xx TPM 2.018FIPS 140-2 Security Policy

5. Key and CSP ManagementTable 10 specifies each cryptographic key or CSP utilized by the Module.For access type description, the following acronyms are used:W - Write; the CSP is updated/written by the TPME - Execute; the CSP is used by the TPM for executionTPM commands that have CSP as input/output parameters shall use parameter encryption.Table 10. Cryptographic KeysKey o rCSPFunc.EncryptionkeysAESAKW HKDFaDRBGCKGUsed to :- W rap keys: f or import/duplication, forwrapping keys stored outside the TPMand for session keys (audit orparameter encryption)- Encrypt/decrypt input/outputparameters- Decrypt credentialsKeys generated using DRBG, derivedusing KDFa or securely transportedusing public/private storage keys.Encrypt - EDecrypt - EZeroize - WKey Import - E, WKey Gen erate - WKey Duplicate - EPublicverif icationkeysRSASARSAKGECDSAECCKGDRBGUsed to verif y signatures on data , asservice f or external application, or aspart of Authorization Policy verif ication.Keys may be generated in the TPM (aspart of Identity key generation) orloaded f rom external source.Zeroize - WKey Gen erate - WRSA Verif y - EECDSA Verif y - EKey Import - WPublicstorage keysRSAESRSAKGKDFaDRBGUsed to transport keys generatedexternally or generated by TPM.Keys may be generated in the TPM (aspart of Private storage key generation)or imported f rom external source.Encrypt - EZeroize - WKey Gen erate - WKey Import - WKey Duplicate - EPrivatestorage keysRSAESRSAKGKDFaAKW HDRBGUsed to transport keys generatedexternally or generated by TPM.Keys may be generated in the TPM(stored encapsulated or wrappedoutside the TPM) or imported f romexternal source.Decrypt - EZeroize - WKey Gen erate - WKey Import - E, WKey Duplicate - ENPCT7xx TPM 2.0Usage19Service - AccessFIPS 140-2 Security Policy

Key o rCSPFunc.UsageService - AccessIdentity keysRSASARSAKGECDSAECCKGKDFaAKW HDRBGAuthorization tokens used to proveTPM identity to other parties .Used to sign information generated orcontrolled by the TPM.Keys may be generated in the TPM(stored encapsulated or wrappedoutside the TPM) or imported f romexternal source.Zeroize - WKey Gen erate - WRSA Sign - EECDSA Sign - EKey Import - WTPM Identity - EEphemeralkeysECDHECCKGKDFaAKW HDRBGUsed to exchange secrets to establisha symmetric key , using One-PassDiff ie -Hellman .Used f or:- Encryption of authorization sessionsalt- Secret sharing f or duplication- Secret sharing f or credentialsKeys may be generated in the TPM(stored encapsulated or wrappedoutside the TPM) or imported f romexternal source.Key Generate - WKey Duplicate - EKey Agreement - EH MAC keysH MACAKW HDRBGCKGUsed to calculate and verif y MAC codesf or data .Used f or:- Ensuring associat ion of credentialwith a loaded object- Access or usage authorization- Symmetric s igning- AuditKeys may be generated in the TPM(stored encapsulated or wrappedoutside the TPM) or imported f romexternal source.Zeroize - WMAC, MAC Ver if y - EKey Gen erate - WKey Import - WKey Duplicate - EInstall Module - W , EDRBG seedsDRBG Used to seed the DRBG , generated byNDRBG the NDRBG.Endorsement RSAES Authorization tokens used to prove tokeysRSAKG the external parties that TPM is aECDH genuine TPM.ECCKG Keys may be generated in the TPM orKDFainstalled during TPM manuf acturing.DRBGNPCT7xx TPM 2.020Zeroize - WKey Gen erate - ETPM Get Random - ETPM Sti r Random - WDecrypt - EZeroize - WKey Generate - WKey Agreement - ETPM Endorsement - EFIPS 140-2 Security Policy

Key o rCSPFunc.UsageService - AccessPlatform keys AESKeys used by the Platform Firmwa re .RSAESRSASARSAKGECDHECDSAECCKGKDFaDRBGEncrypt - EDecrypt - EZeroize - WKey Gen erate - WRSA Verif y - ERSA Sign - EECDSA Verif y - EECDSA Sign - EKey Import - EKey Duplicate - EKey Agreement - EInstall Module - W , EFirm wareUpdate keyRSA Verif y - EFirm ware update - ERSASA Used to verif y signature on f irmwareupdates.Key installed at the modulemanuf acturing .NPCT7xx TPM 2.021FIPS 140-2 Security Policy

6. Self Tests6.1 Power-On Self TestsThe Module implements the following tests during power-on:Table 11. Power-On Self Tests (POST)Cryptography FunctionT est T ypeFirm ware integrityMAC using a 128 -bit error detection codeH MACFIPS 198 -1 KAT using SHA2-384SHA-1, SHA2-256 , SHA2-384 FIPS 180 -4 KAT for each SHA typeAES Encryption / DecryptionFIPS 197 KAT f rom SP800 -38AKDFaSP800 -108 KATKDFe 2 (f or ECDH)SP800 -56A rev. 3 KATDRBGSP800 -90A KAT (DRBG Generate, Reseed andInstantiate )SP800-56A rev. 3, section 6.2.2.2. The KDF used is the “One-Step Key Derivation” according to SP800-56C,section 4”.2NPCT7xx TPM 2.022FIPS 140-2 Security Policy

6.2 Conditional Self TestsThe Module implements the following conditional tests:Table 12. Conditional Self TestsCryptographyFunctionConditionT est T ypePOSTPOSTAll tests listed in Table 11ECDSAsign / verif yTPM2 Self Test(f ullTest YES) in transition toApproved Mode 2FIPS 186 -4 KATECDHTPM2 Self Test(f ullTest YES) in transition toApproved Mode 2SP800 -56A rev. 3 KATRSAsign / verif yTPM2 Self Test(f ullTest YES) in transition toApproved Mode 2PKCS#1v2.1, FIPS 186 -4 KATRSA keygenerationKey GenerationConditional pair -wise consistencycheck f or RSA public -private keypairs each time an RSA key pair isgenerated, using FIPS 186 -4ECC keygenerationKey GenerationConditional pair -wise consistencycheck f or ECDSA public -private keypairs each time an ECDSA key pairis generated, using FIPS 186 -4Firm ware LoadTestField UpgradeFirm ware update test during thef irmware update. The digitalsignature is verif ied on t hef irmware image using an RSA(SHA2 -256) algorithm, utilizing a2048-bit Firmware Update keyDRBGNew bits are generatedContinuous Self TestNDRNGNew bits are generatedContinuous Self TestIf a conditional or power-on self test fails, the Module enters an error state where both dataoutput and cryptographic services are disabled.NPCT7xx TPM 2.023FIPS 140-2 Security Policy

7. Physical SecurityThe TPM is implemented as a single integrated circuit (IC) device that attaches to standardsystem PCBs. It is manufactured using de-facto standard integrated circuit manufacturingtechnologies, producing a device that meets all commercial-grade power, temperature,reliability, shock and vibration specifications.The TPM IC physical package provides hardness, opacity and tamper-evidence protectionconforming to FIPS 140-2 Physical Security Level 2. The TPM achieves this level of protectionby implementing an enclosure that is both hard and opaque, as shown in the figures in Section1. This type of IC package ensures that any physical tampering will always result in scratches,chipping or other visible damage on the enclosure.Before the TPM is integrated into a target application system, it must be checked visually fortampering. After it is integrated, typically through soldering onto a PCB, it can be inspected fortampering by opening the application system enclosure and examining the TPM.NPCT7xx TPM 2.024FIPS 140-2 Security Policy

8. Electromagnetic Interference and Compatibility (EMI/EMC)The Module complies with the EMI/EMC requirements spec

NPCT7xx TPM 2.0 8 FIPS 140-2 Security Policy 1.2 Approved Modes For some TPM host platforms, it might take too much time to execute all self tests during power up. Therefore, the TPM supports the following two Approved modes. 1.2.1 Approved Mode 1 This mode is the default mode when the TPM powers up. Table 2. Approved Mode 1 Properties Description