Hi Veraison maintainers,
We are reporting a freshness validation issue in the parsec-tpm attestation scheme.
While testing parsec-tpm end to end through the challenge-response API, we found that TPM evidence whose quote is bound to an old or different nonce can still be submitted to a later session and receive an affirming appraisal result.
In our test, the same valid TPM evidence was submitted to two independent challenge-response sessions. Each session had a different challenge nonce, but both submissions were accepted. The EAR result reported the current session nonce, but the verifier did not appear to compare it with the nonce cryptographically bound inside TPMS_ATTEST.ExtraData.
Expected behavior: parsec-tpm should reject evidence when the quote nonce does not match the active challenge/session nonce.
Impact: a relying party may treat replayed TPM evidence as proof of the current platform state.
We confirmed this behavior using live TPM hardware evidence. We can share reproduction material privately if needed.
Would it be acceptable for us to open a PR with a fix and regression test?
Best regards,
Kaled Aljebur & Narjis Aljebur
Hi Veraison maintainers,
We are reporting a freshness validation issue in the parsec-tpm attestation scheme.
While testing parsec-tpm end to end through the challenge-response API, we found that TPM evidence whose quote is bound to an old or different nonce can still be submitted to a later session and receive an affirming appraisal result.
In our test, the same valid TPM evidence was submitted to two independent challenge-response sessions. Each session had a different challenge nonce, but both submissions were accepted. The EAR result reported the current session nonce, but the verifier did not appear to compare it with the nonce cryptographically bound inside TPMS_ATTEST.ExtraData.
Expected behavior: parsec-tpm should reject evidence when the quote nonce does not match the active challenge/session nonce.
Impact: a relying party may treat replayed TPM evidence as proof of the current platform state.
We confirmed this behavior using live TPM hardware evidence. We can share reproduction material privately if needed.
Would it be acceptable for us to open a PR with a fix and regression test?
Best regards,
Kaled Aljebur & Narjis Aljebur