Are those SHA1 updates of the PCRs protected somehow when traversing the bus between the CPU and TMP?
Cutting the bus and inserting your own microcontroller that captures valid updates and replays them sounds like it would be within reach for even a hobbyist, especially in the I2C case.
A successful replay attack would open the door to replacing the boot loader and doing all kinds of mischief...
That I2C bus sounds ripe for interception.
Cutting the bus and inserting your own microcontroller that captures valid updates and replays them sounds like it would be within reach for even a hobbyist, especially in the I2C case.
A successful replay attack would open the door to replacing the boot loader and doing all kinds of mischief...
/greger