docs(spec): TPM security model for non-confidential-compute devices - #439
Merged
Conversation
States what the TPM path guarantees today, what it does not, and the target model, so partner conversations about AI PC deployments have one consistent answer. Records the gaps as tracked issues rather than prose: quote signature discarded, quote called with a capability query, no AK or EK chain, gateway never measured, no event log. Notes that PCR 23 and 16 are resettable from locality 0, so an application PCR alone is advisory and an NV extend index is preferred. Refs #429, #430, #431, #432, #433, #434, #435, #436 Signed-off-by: Imran Siddique <imran.siddique@opaque.co>
imran-siddique
added
documentation
This was referenced Jul 30, 2026
imran-siddique
added a commit
that referenced
this pull request
Jul 30, 2026
Rewrites the framing so the document does not read as directed at one external party. Section 6 becomes open ecosystem questions applying to any TPM vendor and any hosted attestation service, and the device framing generalises to devices without confidential compute. Wording only, no technical claim changes. Also corrects section 4.7, which said the claim-tiering change landed in #437. It did not once #437 was narrowed to the parser fix, so it now reads as proposed and records that it contradicts an existing test assertion. Refs #436, #439 Signed-off-by: Imran Siddique <imran.siddique@opaque.co>
imran-siddique
added a commit
that referenced
this pull request
Jul 30, 2026
Rewrites the framing so the document does not read as directed at one external party. Section 6 becomes open ecosystem questions applying to any TPM vendor and any hosted attestation service, and the device framing generalises to devices without confidential compute. Wording only, no technical claim changes. Also corrects section 4.7, which said the claim-tiering change landed in #437. It did not once #437 was narrowed to the parser fix, so it now reads as proposed and records that it contradicts an existing test assertion. Refs #436, #439 Signed-off-by: Imran Siddique <imran.siddique@opaque.co>
imran-siddique
added a commit
that referenced
this pull request
Jul 30, 2026
A PCR read carries no signature and nothing binds it to a TPM, but the provider still reported provider=tpm when the quote failed, and the subprocess path never produces a quote at all. _downgrade_note now applies the existing SHA-1 policy to both cases: without quote evidence the report is software-only with the note tpm-pcr-read-unsigned. This is a behaviour change. test_tpm_sha256_success_subprocess_keeps_tpm_provider deliberately asserted the opposite; it is renamed and updated, since the SHA-256 bank being available says nothing about whether the report is signed. Implements section 4.7 of docs/spec/tpm-security-model.md. Closes #436 Refs #429, #430, #439 Signed-off-by: Imran Siddique <imran.siddique@opaque.co>
imran-siddique
added a commit
that referenced
this pull request
Jul 30, 2026
A PCR read carries no signature and nothing binds it to a TPM, but the provider still reported provider=tpm when the quote failed, and the subprocess path never produces a quote at all. _downgrade_note now applies the existing SHA-1 policy to both cases: without quote evidence the report is software-only with the note tpm-pcr-read-unsigned. This is a behaviour change. test_tpm_sha256_success_subprocess_keeps_tpm_provider deliberately asserted the opposite; it is renamed and updated, since the SHA-256 bank being available says nothing about whether the report is signed. Implements section 4.7 of docs/spec/tpm-security-model.md. Closes #436 Refs #429, #430, #439 Signed-off-by: Imran Siddique <imran.siddique@opaque.co>
imran-siddique
added a commit
that referenced
this pull request
Aug 1, 2026
…921a76 The previous commit's message and PR #454 described three changes to this file that were not actually in the committed content: the P3/P4 reorder, the section 7 tier-table refresh, and the section 8 rewrite. Each edit reported success and then was not present on disk at commit time, so the commit recorded intent rather than substance. Something else is writing this repo concurrently (STATUS.md changed the same way). Re-applied and verified present by grep before committing: - header no longer says awaiting approval from three reviewers - section 7 row three states what ships, with the host-dependency and unsigned-measurement caveats - section 5 P2 records the certify-twice decision - P3 is sealing, P4 is the event log, with the reorder rationale - the 'kept as P3' cross-reference matches the new numbering - section 8 is decisions taken, not approvals requested Refs #432, #439, #453 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
imran-siddique
added a commit
that referenced
this pull request
Aug 1, 2026
…921a76 (#458) The previous commit's message and PR #454 described three changes to this file that were not actually in the committed content: the P3/P4 reorder, the section 7 tier-table refresh, and the section 8 rewrite. Each edit reported success and then was not present on disk at commit time, so the commit recorded intent rather than substance. Something else is writing this repo concurrently (STATUS.md changed the same way). Re-applied and verified present by grep before committing: - header no longer says awaiting approval from three reviewers - section 7 row three states what ships, with the host-dependency and unsigned-measurement caveats - section 5 P2 records the certify-twice decision - P3 is sealing, P4 is the event log, with the reorder rationale - the 'kept as P3' cross-reference matches the new numbering - section 8 is decisions taken, not approvals requested Refs #432, #439, #453 Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
6 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
docs/spec/tpm-security-model.md, a written security model for the TPM path on devices without confidential compute.Why now. cMCP claims hardware attestation on the TPM path, and that claim was never written down or checked against the code. It does not hold. Anyone evaluating a deployment on a device without confidential compute asks what integrity guarantees a TPM actually provides, and we had no precise answer. This settles it and gives the docs one consistent vocabulary.
What it says. Today the TPM path is an unsigned, self-reported PCR digest. The quote signature is discarded (#429), the quote is called with a capability query instead of a key handle so it never succeeds (#430), there is no AK or EK chain (#431), the gateway is never measured into a PCR (#432), and no event log is shipped (#433). It also records the parser bug that corrupted the measurement itself (#434, fixed in #437) and the claim-tiering proposal (#436).
One design correction worth reading. The obvious fix for #432 is to extend an application PCR, but PCR 23 and PCR 16 are resettable from locality 0 per the TCG PC Client Platform TPM Profile. An adversary with local code execution can reset and re-extend, which is exactly the adversary this tier targets. The RFC therefore prefers an NV extend index with a write policy, or sealing across non-resettable SRTM PCRs.
Decision requested. Approve the P0 through P5 ordering in section 5 and the three-tier vocabulary in section 7. Section 4.7 also needs an explicit call, since the claim-tiering change contradicts an existing test assertion and ships separately.
Approvals needed from @podcastinator, @AaronRoeF, and @katy-gordon before this leaves draft.
Tracking: #429 #430 #431 #432 #433 #434 #435 #436