Bring Your Own Root Of Trust

The talk opens with what a hardware root of trust is for: verifying boot code, measuring what ran, storing keys, and attesting platform state. The speakers separate external root-of-trust chips, which sit on the motherboard, from internal ones built into the processor package. They argue that an external chip is the easier target, and they describe NVIDIA DPU boards that use a Microchip external root of trust. One board had a test-bypass pin that could be reached with a fine wire under the package, which they said they had not fully tested on the target hardware.

For the second part, they set out to build a cheap stand-in for a discrete SPI TPM. Microcontrollers were too slow to answer the bus in time, so they moved to small FPGA boards. A low-cost Tang Nano board first ran as a minimal TPM that reported only static PCR values, and Windows accepted it. A later version sat between a real TPM and a motherboard with a logic analyzer, and it forced PCR extends to a fixed value while passing every other command through. Windows still rejected the setup for BitLocker because it checks the TCG event log. Most of the Verilog was written with an AI assistant, which the speakers presented as the main change in who can attempt this work.

The closing takeaway is that the required hardware costs tens to a few hundred dollars. Attackers could use this to spoof hardware identity, fake PCR state for measured boot, or probe attestation. The speakers note that early boot measurements are harder to forge, and that anti-cheat systems detected their test setup. They say the code, gateware, prompts, and data are being released for others to reproduce.