What is TPMFail attack and what are the countermeasures? Trusted Platform Module (TPM) is designed as a hardware-based root of trust to protect cryptographic keys even against system based adversaries. 

Although Intel's firmware based fTPM has FIPS 140-2 and STMicroelectronics hardware-based TPM has Common Criteria EAL 4+ certifications, recently in an attack TPM-FAIL: TPM meets Timing and Lattice Attacks by Moghimi et al., They demonstrated that an attacker can recover server's private authentication key even by remotely.


How do the attacks work?
What are the countermeasures?
In short, TPMFail attack is black-box timing analysis of TPM 2.0 devices deployed on computers. The TPMfail team is able to extract the private authentication key of TPMS's 256-bit private keys for ECDSA and ECSchnorr signatures, even over networks. This attack successful since there was secret dependent execution in TPMs that causes the timing attacks. To mitigate this attack, a firmware update needed for Intel fTPM and hardware replacement for STMicroelectronics TPM is needed. 


  How do the attacks work?


The attack is performed in three phases


Phase 1: The attacker generates signature pairs and timing information to profile of the given implementation fTPM or STM's. This is the pre-attack stage and the attackers know the secret keys and used nonces. This profile can be measured of-site. After the measurement, they have complete correlation information about the timing and secret nonce $k$ used in signatures. The bias is related to Leading Zero Bits (LZB). 
Phase 2 With the timing on their hand the attackers target a system with the same TPM devices and collect signature pairs and timing information.
Phase 3 The attacker applies lattice-based cryptanalysis with filtered signatures to get biased nonces to recover the private key. 


In more Details


The timing measurement Normally Intel fTPMs Linux kernel driver uses command response buffer in push mode. The driver checks the status after 20 milliseconds, if the calculation is not ready, the driver re-checks. It doubles the time for every check. This driver doesn't allow a perfect timing measurement, therefore, the TPMfail team developed their kernel driver to perfectly measure the timing. They collected 40000 ECDSA signature. They similarly build a driver for STM's hardware TPM. 
Timing Analysis: They discovered that a bit-by-bit scalar point multiplication implementation that skips the computation for the most significant zero bits of the nonce. Therefore nonces with more leading zero bits are computed faster in TPMs.


On the below figure it is Intel fTPM's timing histogram. On the right a nonce depended software implementation. Comparing the figures leads to the information that Intel used a 4-bit fixed window during Fixed Window Scalar Multiplication.



In the left figure, there are 4 regions, the fastest one has nonces with 12 most significant windows are zero, next has 8, next has 4, and the slowest region has none.

The Lattice-based Cryptoanalysis

They used The Hidden Number problem lattice attacks. They used BKZ algorithm over the Sage. This attack recovers ECDSA nonces and private keys as long as the nonces are short. Since nonces are selected randomly half of them have zero in MSB, a quarter of them have two zeroes in MSB, etc. The side-channel will help to select the shorter nonces to apply the lattice-based attack.

The key recovery with attack models


System adversary a user with administrator privileges to extract the keys. The required signature for 12, 8, and 4 leading zeros for ECDSA

\begin{array}{|c|c|c|c|}\hline
\text{bias} &amp; \text{need signatures} &amp; \text{total sign operations} &amp; \text{succes rate}  \\\hline 
4-bit &amp; 78 &amp; 1248 &amp; 92\text{%}\\ \hline
8-bit &amp; 34 &amp; 8748 &amp; 100\text{%}\\ \hline
12-bit &amp; 23 &amp; &amp; 100\text{%} \\ \hline
\end{array}

The time for collecting signatures on i7-7700 is 385 signature/minute. Collecting the 8784 signatures took less than 23 minutes. Once the data is collected the Lattice attack took 2 to 3 seconds! for dimension 30.

For Intel fTPM Schnorr signatures in 27 minutes 10,204 signature are collected with 8-bit leading zeroes. For 4-bit case 65 samples found from 1.040 signature in 1,5 minutes.

STMicroelectronics TPM ECDSA Key Recovery

They were able to recover the ECDSA key after 40,000 signature for 8-bit with 35 fastest signatures.  
User level as before mentioned, in user-level the kernel driver checks the result, first in 20 micro seconds. This lead the below timing measure;



They collected 219,000 signatures that contain noisy 855 8-bit leading zeros. With filtering, they get 53 high-quality signatures with 100% recovery rate. They also look for the 4-bit case.
Remote adversary This is the weakest adversary in terms of capability. They set up a fast 1G network and requested 40,000 signatures to collect timing information. Although the timing histogram noisier, it still shows information about nonces with 4 and 8-bit leading zeroes. For the 4-bit case; 1,248 signatures are collected in less than 4 minutes and for the 8-bit case; the required signature is collected in 31 minutes.




They used this remote attack against StrongSwang, an open-source IPsec VPN implementation that is supported by modern OSes, including Linux and Microsoft Windows. 


  What are the countermeasures.


countermeasures


The kernel driver can increase the delay time so that this doesn't leak information. However, this may require different levels with different TPM devices. Therefore this is no bulletproof.
Constant time implementation. This is the key to the attack point. With data depending calculation the TPMfail team is able to distinguish the calculations. Once calculations are done in constant time, the side channel will be harder. They have testest the patches and couldn't execute the attack anymore. 
Using double size nonce and setting the high bit to 1 *


Patches


CVE-2019-11090. Intel issued a firmware update for Intel Management Engine (ME) including patches to address this issue on November 12, 2019. 
CVE-2019-16863. STMicroelectronics updated version of their TPM product for verification and sent to authors. They tested and see that it is resistant. Since it is hardware it requires replacement.




Note: From authors: 


  TPMs have previously suffered from vulnerabilities due to weak key generation. However, It is widely believed that the execution of cryptographic algorithms is secure even against system adversaries.


*Thanks to commentors. See :Why EdDSA held up better than ECDSA against Minerva. Minerva is also a smilar work on smart cards.