Re: A _good_ and valid use for TPM

[Alex Besogonov]

On Sat, Feb 21, 2009 at 3:46 PM, Robert Millan <address@hidden> wrote:
>> Yes, I'm trying to do remote attestation.
> You're confusing things.  I think you simply want to ensure data integrity, 
> and
> the TPM doesn't even do that: it simply puts the problem in hands of a third
> party.
No, I'm not confusing anything.

> "remote attestation" is only useful when you want to coerce others into
> running your (generaly proprietary) software.  I hope this is not what you
> want to do.
It's exactly what I want to do (minus the 'coercing' part). I want to
ensure that devices run only my unmodified software (which I consider
secure) and only in this case provide decryption keys for sensitive
data. Of course, it done not for DRM purposes, but rather to protect
sensitive data from theft (real theft, not copyright infringement).

>> Well, I spoke phcoder on Jabber - there might be a way to do this.
>> He's going to investigate it.
> This is unnecessary.  Once GRUB supports crypto, it can simply load
> itself from an encrypted filesystem on disk.  An image can be of
> arbitrary size.
Nope. Still no way to test system integrity.