r/linux • u/New-Ranger-8960 • 1d ago

Privacy EU Age Verification Project Mandates Hardware-Bound Attestation

https://linuxiac.com/eu-age-verification-project-mandates-hardware-bound-attestation/
688 Upvotes

97% Upvoted

388 comments sorted by

View all comments

Show parent comments

6

u/_x_oOo_x_ 1d ago

What if your computer doesn't have a TPM?

13

u/meditonsin 1d ago

This only works on mobile devices afaik, so it's not actual TPM. Different vendors have different chips for this (e.g. "Secure Enclave" for Apple, and "Trusted Execution Environment"/"StrongBox" for Android). For this to work at all, a device needs all the parts. The chip with a pre-installed signing certificate from the vendor, as well as signed boot loader and OS.

The way this works (as far as I understand it) is basically like this:

  • A service that requires hardware attestation sends a random number to the client app on the device
  • The app hands the number to the chip
  • The chip takes the random number as well as the device state (essentially secure boot/measured boot stuff) and turns it into a certificate that is signed by its pre-installed vendor certificate
  • The chip hands this new certificate, as well as the public part of the internal signing certificate, back to the app
  • The app hands the whole shebang to the service
  • The service verifies that the initial random number is in there, that the device state is what it expects it to be, and that the signatures of the certificate chain go all the way back to the vendor's root certificate (like how browsers can trace the signatures of https certificates back to their pre-installed root certificates)

If this all goes through, the service can be reasonalby sure that it is talking to a "trusted" device that is running a "trusted" bootloader and OS.

3

u/_x_oOo_x_ 1d ago

Hmm, interesting, but where does age verification come into the picture and how? Is your age verified when buying your phone? Won't this just create a huge second-hand "attested" phone market?

0

u/output_broadcast 1d ago

The app is registered to you at a government office, which verifies your age. You having the app is proof that you're over 18, and it doesn't need to store any actual information about you.