Reconstruction of PCR register from ASCII measurements

40 Views Asked by At

I have simple linux IMA measurements and I am trying to reconstruct PCR registers for remote verification.

10 4347bff321748edf90d2dc40edaa1b54c7eaaa16 ima-ng sha256:de2e7b1bc7a2aed4e5866d3655d1041206c27caf376ee81bfc4012e8225e0e7c /usr/share/ca-certificates/mozilla/UCA_Global_G2_Root.crt
10 cfa34f58e8319181173d9b9f6345aa3a367702d3 ima-ng sha256:7aa7e87cb29fb7303d8d2402c98b3855b45859640211773c279f0c046e2071c6 /usr/share/ca-certificates/mozilla/E-Tugra_Global_Root_CA_ECC_v3.crt
10 7dd199a752c6484ee8d3c11337dcd8b49f82fa6e ima-ng sha256:05161ad2ac04a0df956ef803e127aa877cc5131e0a727ed8e5de43f02e8868c4 /usr/share/ca-certificates/mozilla/DigiCert_TLS_ECC_P384_Root_G5.crt
10 e9edbe721d1e0c27163c79378a6867a4d4a36ffd ima-ng sha256:2b0b73d3dc775b865bd38a4400bf5020b3c1df3ccb171db98bfcaafed8a49470 /home/verifier/code_examples/cpp-examples/.git/config
10 e5ce41ea6573d2744fb325613c2c8c4ad9b7190b ima-ng sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 /home/verifier/code_examples/cpp-examples/.git/objects/pack/tmp_pack_qM1wJZ
10 0000000000000000000000000000000000000000 ima-ng sha256:0000000000000000000000000000000000000000000000000000000000000000 /home/verifier/code_examples/cpp-examples/.git/objects/pack/tmp_pack_qM1wJZ
10 0000000000000000000000000000000000000000 ima-ng sha256:0000000000000000000000000000000000000000000000000000000000000000 /home/verifier/code_examples/cpp-examples/.git/objects/pack/tmp_pack_qM1wJZ
10 0000000000000000000000000000000000000000 ima-ng sha256:0000000000000000000000000000000000000000000000000000000000000000 /home/verifier/code_examples/cpp-examples/.git/objects/pack/tmp_pack_qM1wJZ
10 bd22836913d6df07e8467fd64c58f02473203884 ima-ng sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 /home/verifier/code_examples/cpp-examples/.git/objects/pack/tmp_idx_3tSjWT
10 65a631f51219253d424893ef413f1064bb347b05 ima-ng sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 /home/verifier/code_examples/cpp-examples/.git/objects/pack/pack-b1d33a47772de5cd9a6ba6149ded5aa281790754.keep

I know that the PCR registers will be extended by: PCR := SHA1(PCR || data), i.e. "concatenate the old value of PCR with the data, hash the concatenated string and store the hash in PCR". But as we can see that some template hashes of these measurement logs are 0000000000000000000000000000000000000000 . How IMA deal with these kind of measurements?

I have tried these methods but none of them works and I am not be able to reconstruct the final PCR value correctly.

  1. Extend 0000000000000000000000000000000000000000 to pcr values.
  2. Skipping them.
  3. manually calculates the SHA1 template-hash of data and extend the values.

Reconstruction of PCR registers with 0000000000000000000000000000000000000000 template-hash

1

There are 1 best solutions below

0
Ken On

All zeros in the log result in all ones being extended.

I have preliminary documentation here:

https://ima-doc.readthedocs.io/en/latest/event-log-format.html#pcr-extend-type-1-zero-pad