Our next talk is going to be by James Bottomley about enhancing Linux security with a TVM. Thank you. Okay, well, hi everybody. Thank you very much. My company communications department told me to always put the email address, and apparently they insist on a Twitter account as well now. My email address I'm responsive on, my Twitter account is pretty much right only, so please don't use it. I'm originally a container evangelist. I've been doing open source for a very long time. I've actually worked a bit in converting business models to open source, and I'm also a kernel developer. The only thing you should probably notice from this impressive CV is that security isn't on it anywhere. The talk I'm going to give you about the TVM is talk about something that actually just annoyed me personally in Linux and I determined to fix in the tradition of open source. So TVM is not actually one of the things that was my natural area of expertise until one day I got really annoyed with the USB key dongle. So to begin, let's talk about security and trust. Everybody needs help protecting secrets.  And usually on the internet or in all electronic commerce we use some form of asymmetric private key, public private key system like RSA or ECC to represent our identity. So pretty much these keys represent who we are on the web.  And obviously if they get lost or stolen, you can be impersonated on the internet. The current state of the art for protecting your keys, if you're not one of these people who just uses a key store on your laptop and is happy with unlocking it with a password, is a key dongle. I did actually have one, but I lost it so I can't show you what they look like, but they're usually little USB keys that you plug into your laptop that store one private key. And this is a big problem because many of them only store one private key. But unfortunately if you're like me, I have about 12 keys on my laptop representing my VPN. I've got about five SSH keys. I've got about four PGP keys. I've actually got several CA security keys for a few things. So all of these keys mount up. And if I have to have one dongle per key, I end up with this huge key ring of dongles and I can never remember which one is which when I need to plug it in for my private key. So using a TPM instead of these dongles to protect your keys actually scales to thousands of keys. The TPM has no limitation as to the amount of keys it can actually manage, which makes it a really useful entity for actually doing this. And the other thing about the TPM which is really useful is it's fully ubiquitous. Everybody who has a laptop in this room today has a TPM sitting inside that laptop. Now not everybody has TPM 2.0. The reason we're getting TPM 2.0 is because it's a Microsoft mandate for Windows 10. But all modern laptops now ship with TPM 2.0, which is what I'm going to talk about. My Dell Skylake XPS actually shipped with the TPM 1.2, but it was software-upgradable to TPM 2.0. So that's basically what I did for this. So the TPM itself sitting in your laptop is a separated security module. So it's a little chip that actually sits outside the main CPU and it has its own access to shield and memory. That means anything you put into it can't be extracted by the CPU of the system, which is useful. And they've been ubiquitous in your laptops for a while now at the 1.2 level. The main problem with the TPM is they actually have a horrifically bad programming experience. I mean, really, really awful. And I speak as one who's actually tried to use it in the 1.2 incarnation. They have a body of people who look after them called the Trusted Computing Group. And they mandate this thing called the Trusted Security Stack, the TSS and shorthand jargon. And it is really appalling. You don't need to see this. All you need to see is that the TPM, the actual thing sits down here.  Now, in Linux, we had a 1.2 TSS implementation called Trousers. Almost nobody will have that installed on their laptop. Most distributions do still package it. It had a few problems with the conversion of open SSL 1.0 to 1.1 and various other things. Its implementation of that huge model is actually three-tiered. So it has your application that you link with the Trousers library. It has this thing called the Trusted Demon that actually has to run in your system, started by SystemD. This Trusted Demon communicates with the kernel TPM driver which communicates with the TPM. It looks simple. The problem is that in order for the application to understand how to use Trousers, it actually has to understand all the library interfaces. So it has to understand the Trousers API. It's fine. Then you have to understand how the TCSD actually interacts with the kernel TPM. And finally, you actually need to understand how the TPM works. And the problem here is that there is no encapsulation between any of the layers. So understanding leaks all the way up and down this stack. And that means that if you just understand the TPM, you can't program Trousers. If you just understand the TPM and TCSD, you still can't program Trousers. You need to understand all of these three components. The amount of information you need to understand is three times more than is actually necessary. And this has proved to be an almost insurmountable burden for application programmers. With the net result, the Trousers API is almost never used, unfortunately. The API is actually quite useful. The idea is that the Trousers library itself does all the HMAC authentication, which means the TCSD doesn't really have too many secrets in it. There are ways when secrets actually flow that way and that way, the TCSD could intercept them. So it does represent a security problem in your system. But by and large, the design is reasonably good. It's just the programming API is awful. So what we plan for TPM 2.0 is to try and do much better. And the problem here is that the Trusted Security Group thought that their model wasn't complex enough for 1.2, so they made it even worse for 2.0. So the actual functions that a TPM can do are shielded key handling, measurement, which is, if you've heard about Trusted Boot, this is usually the measurement functions, data sealing, that means you can actually put private data into a TPM and not get it out again unless you satisfy certain policy conditions, and attestation. The only one I'll actually be talking about today is shielded key handling, because that's the one that's most interesting to me. So with shielded key handling, keys in the TPM are stored in hierarchies with a well-known key at the top. And I use stored and inverted commas because everybody thinks that the TPM is a place to put keys, but it's not actually true. When a TPM manages your keys, the keys are actually stored in your file system outside the TPM. I'll get onto that in a bit. But the only thing you need to know is that as far as a TPM sees it, keys are always stored in hierarchies with a well-known root at the top. The root is a key that's actually embedded in the TPM. And asymmetric encryption keys, which is what we use for identity, are stored in something called the storage hierarchy. So the TPM itself has four hierarchies. I'll only be talking about one, which is the storage hierarchy. The great thing about TPM 2.0 as opposed to 1.2 is it features algorithm agility. So it can actually do many hashes, it can do many key lengths for RSA, and it can do many elliptic curves, and actually any other different cryptography that came along, it could probably do it. Post-quantum, not sure about, hasn't come along yet, but eventually when it does, there would probably be a TPM 2.0 specification for it. TPM 1.2 was restricted to SHA1 and RSA 2048, and since SHA1 is now a suspect hashing algorithm, it makes TPM 1.2 not very useful for most of the identity stuff we're doing because everybody is now mandating SHA256. So the days of actually using TPM 1.2 for security are numbered. The way TPM 2.0 works with its agile key handling is that instead of generating a key that sits at the top of these hierarchies, it generates what's called a seed. A seed is just basically a random number that can be used to derive a key. So the TPM 2.0 goes from seed to key via something called a key derivation function. These are sort of complex cryptographic things you don't need to understand. All you need to know is I place a long random number in, and the output I get is a public-private key pair for any algorithm. And obviously if I put the same number in, I get the same key pair out. That's the essential thing of a key derivation function. So the TPM doesn't really need to know the public-private key pair for any of its crypto agile systems. It just uses the seed to derive it. And that means that if any additional crypto was added, it could still use the same seed to derive the same key pair. The problem with these key derivation things is that for RSA, the key derivation function involves finding prime numbers. And the TPM itself is a very small, very slow mathematical engine. It takes a long time to find prime numbers. This means that if I actually... TSS-CreatePrimary is the command you use to tell it to go from the seed to an incarnation of the public-private key pair. So I've actually told it to generate an RSA key from the storage hierarchy.  This is on my actual laptops. This is one of the more modern Nuviton 6X TPMs. It took it 43 seconds to generate the public-private key pair using the prime generation functions. So this is not something you want to do with every cryptographic operation. Obviously elliptic curve keys can be generated much faster because of the way elliptic curve works, but RSA keys take an age to generate. The storage seed changes if the TPM is ever reinitialized. So this means that if your security is compromised, you can just reinitialize the TPM and every key you put into it is wiped because they can no longer be understood by the TPM itself. Keys to be inserted into the TPM are encrypted based on a known public key. That known public key is the root of the storage hierarchy, the storage seed, or the key you derive from the storage seed. And that means that only the TPM itself can decrypt them when you put them in. So this is what the security of the system relies on. And once a key is actually translated to TPM form, it cannot be translated back. So once you have the TPM form of a private key, you cannot go back to the non-TPM form. So it's a one-way function. You don't get the key back ever. This means it can never be extracted, which is useful for security. So if I tell you about TPM 2.0, like 1.2, as I said, the trusted computing group is writing a trusted security stack for it. And it looks like this. So it's got their usual levels of complexity. In fact, it's got a few more levels of complexity. New things have appeared like a resource manager for various reasons. And the API, instead of there only being one API at the top, there are now technically four, because TIC-T itself is also an API. So we've got about four times the complexity we had in 1.2, which most people agree was an unusable API. And the problem is that it's still not complete. If you actually look at this, as far as writing all of this, the resource manager spec isn't quite finished, but it's about there. System API exists. ESAPI is not standardized, and the feature API is still going through some weird iterations that I didn't really understand. And in theory, a resource manager is now required for TPM 2.0, because it has space for only three transient objects. Every key you insert into a TPM is effectively a transient object. That is why the TPM itself doesn't store your keys. What it stores is an offline representation that you load into the TPM when you want to do an operation, and then unload again. And the reason you have to have a resource manager is because if I have many operations trying to do this, they're actually going to overflow the three-object key space. So if on my laptop I'm running a VPN, and I'm running my GPG, and I'm running my SSH, if they all try and do a signature at once, the TPM is going to run out of space. And the resource manager actually ensures that the TPM doesn't run out of space because it manages the transient object layouts. And as of the Linux 4.12 kernel, the TPM 2.0 resource manager is actually present inside the kernel. So you can just rely on the kernel to do this. You don't need anything else, fortunately. Intel is actually building a trusted security stack to this TCG specifications. It's up there on GitHub, under the Intel GitHub account, TPM 2.0 TSS. I'm currently, unfortunately, unusable for my crypto applications because I need secure key handling going in and out of the TPM, and I need secure authentication handling. And it just so happens, those are features of the thing called the ESAPI API, which currently isn't standardized. So the Intel TSS does not currently have ESAPI. As of today, I think two days ago, they posted a message to the mailing list saying they were actually working on ESAPI and would get it based on the beta version of the spec. So perhaps they will, at one day, have it, but right at the moment, they don't. IBM has actually built a fully functional trusted secure stack, and it's fully complete. It's sitting on SourceForge at IBM TSS 2.0, but it's based on the TPM 2.0 commands. It's not actually based on any of that complicated TCG stuff. So if you understand the TPM commands, you can actually use this IBM stack, which is actually very useful for me because it means that I only need to understand a very small piece of the trusted secure stack actually to get everything working. And the great thing about the IBM TSS is that it does all the necessary crypto for HMAC and command parameter decryption and response encryption in the background, so I don't need to worry about that. So it's as functional as ESAPI would be from the security point of view, but it's just based on the TPM commands, which I find very easy to use. And the other really great thing about it is it makes a direct connection to the internal resource manager itself so it doesn't rely on a demon. And the reason this is a great thing is because some of the demos I'll show you, before I did this for TPM 2.0, I did it for TPM 1.2, and I actually have a TPM 1.2 laptop sitting at home that I used to use, and the user experience was frightful because every time the demon crashed, all of my keys were lost and I had to re-initialize all of the crypto system. So this meant that the demon would just crash and I wouldn't notice. My VPNs would all collapse. My SSH commands suddenly wouldn't be able to re-authenticate.  The user experience of the trousers demon is terrible. Now, I do believe that we do understand how to code demons essential to system function that don't crash. So it should be possible to fix trousers. It's just that nobody understands it well enough, and nobody can be bothered actually to go in there and do this, which is why it's still a horrific experience for everybody concerned. So I regard having no demons in the IBM TSS 2.0 stack as an enormous plus point because the IBM 2.0 TSS has just worked for me from day one on my laptop, which I think is very useful for a security system. And without ESAPI, that also means that the IBM stack is the only current choice for becoming security-related functions. Security-related function is anything where you need to secure the communication between your application and the TPM because you're using it to pass secrets. So that's anything that requires authentication, anything that requires the passing in of private keys. You require security on that channel because the TSS does not mandate any. The TPM can actually be connected over the Internet to your application, and the packets, the command packets that it sends over the Internet are just effectively the ones that you placed into it. And if you don't use the security functions of the TPM, it'll be sending your private keys over the Internet in clear form, which you definitely don't want. So to build a secure cryptosystem, you actually need to understand only five TPM commands, which is useful. There are a couple of hundred TPM commands, but I can actually build a secure cryptosystem only understanding five of them, which means that the amount of the, even the command API I need to understand is fairly small. It's still rather complicated, but it is fairly small. So there's this command called TPM to create. This creates a public-private key pair on the TPM. You use this if you want a public-private key pair that's actually tied to your laptop because that key can never be removed from the TPM. That means that if you change laptop, you lose the key. It has this thing called a parent handle where the parent and the hierarchy is. You usually use the storage root key for that. It has an authority parameter, which is basically a passphrase you put into the key. So obviously, when you're creating the key, you have to secure this. And then it has the public key parameters, which tell it what you want, like, you know, I want an RSA key, I want it to be 2048 bits and so on. There's an import command, which you use to import external private keys. This is mostly what I use for programming cryptosystems because my private keys mostly exist. So for instance, when I use it with GPG, I want to take my certification GPG key and just place it into the TPM. I don't want to have to regenerate a new GPG key and spend two years getting everybody else to sign it. The import actually takes the parent handle, the public parameters, and the actual private key itself. And the TPM will then spit back its form of it. So both commands actually do nothing to this TPM or volatile memory. All they do is they spit back two structures, a public key, which also has all the visible parameters, and a private key blob, which is only readable by the TPM. This is actually encoded usually with an AES 256 key, that is, was regenerated by the TPM when it generated the storage seed. So the point is that this is strongly encrypted and can only be decrypted by the TPM itself. But the public key is bound to the private key, sorry about the spelling mistake, by a hash. That means that even though the public key is in the clear and therefore you could alter the parameters, if you alter any parameters in it maliciously, the TPM will detect that and reject your key. One of the checks it actually does, not only does it check parameters, but it actually also checks the public key matches the private portion whenever you use it. But whenever you want to use the TPM for a shielded key operation, you have to present it with both this public and private blob before you can start that shielded operation. This means that you, the user, are responsible for managing all of this data. There's a command called TPM to load, which is actually used to load this public and private blob, and you tell it what the parent key is. This requires no security at all because the private blob is already encrypted and you don't care if anybody sees your public key. So this is actually rather a nice command. And then after you've loaded the key, you can use signing, which just works, or you can use decryption, which is what you use to decrypt messages encrypted to your public key. This is slightly cheating. I told you there were five commands, but if you notice I've got two commands, one on top of each other. This is because the way decryption works with RSA is not the same as the way it works with elliptic keys, and it can't be made to look the same. So signatures just look the same, whether you have an elliptic key, an elliptic curve private key, or an RSA private key, it just works. Unfortunately, you actually have to understand the difference between RSA decryption and for elliptic curve private keys, you don't actually have a private key decryption function. What you have to do is use an elliptic curve Diffie-Hellman with a temporary public key to actually give you a key agreement that you then use to decrypt the message. So the mode of using it is actually rather complicated, which is why you have two separate commands. But they basically both take the key handle of the loaded key, they take the ciphertext and the padding scheme, and then they will do the decryption for you. As I said, TPM20 keys are demand-loaded, meaning they're not resident in the TPM, unlike USB keys. And this is very important because it means that the TPM gives you back key blobs that you have to keep in a file somewhere. If you lose this file, you've lost your keys. You're responsible for the management, not the TPM. So it's unlike USB keys where the key is actually inside the USB key, as long as you physically have the USB key and don't lose it, you have access to your key. And like I said, the user is responsible for managing these. And TPM20 can only load three keys at once, so you are required to have a resource manager. Now, don't despair, if you have a kernel before 1.12, this, what I'm showing you, can actually work without a resource manager. The problem is that if you use it with too many keys, you're prone to getting an out-of-memory error from the TPM. That's the only real difference. So essentially, if you want to use it with many keys at once, you have to use it with a resource manager. So a little aside on TPM security, lots of sensitive information in the parameters to these commands. Things like the authorization passphrase, the private key and everything. These, you cannot be assured of a secure channel between your application and the TPM. So these must always be secured by the application. There are no ifs, ands, and buts here. One of the useful things about TPM 1.2 is that you couldn't get an insecure channel to the TPM. Whenever you're pressing private parameters, the commands themselves required that you set up a secure channel, which was very easy. TPM20 has what's called the easy button, where you can actually send commands in the clear to it because you pretend you're talking to it over the secure channel. But you should never ever, as an application, assume that you have a secure channel to the TPM and you should always use these encryption functions. So you should never use this TPM-RS-PW easy button. You should always use the proper parameter encryption. And you must secure all data in transit to assure that it's not intercepted by an eavesdropper who would then run off with this key you're desperately trying to shield. And obviously, all of this will be done by the missing ESAPI API when it magically appears. But in the meantime, it is all done by the IBM TSS, which is why I use it. So in order to use security with the TPM, you actually need an additional TPM command called start authentication session. This is a command that actually begins security in the TPM. This is actually a lot better than it was in TPM 1.2. With TPM 1.2, the parameters used for security were fairly fixed and could actually be guessed if the attacker was clever enough. TPM 2.0 uses nonces. So you send a nonce in and it sends a nonce back, and you use these two random numbers, one of which you produced and one of which the TPM produced, to derive the session key that you're going to use to communicate with it. You also have something called assault key which you use to secure secrets, and you can have a binding key, which you also use for a shared authority to secure secrets. Both of these parameters can be blank, but you do require some form of shared secret with the TPM to securely derive a session key that can be used to communicate with it. So if you're communicating with an authorized object, the TPM knows the authorization. You know the authorization. You use that to derive a secure key for the HMAC session, which means you don't need any of these sold keys or binding keys. However, if I don't have any authorization, so for instance, I'm trying to place a private key on the TPM that is actually going to run off the root of the storage hierarchy. The authorization of the storage hierarchy is usually known by everybody. It's a blank authorization. So I cannot use that for deriving any shared secrets. So I actually tend to use a salt key which is used to encrypt a secure parameter to the public part of that key. The salt key usually uses the parent key of the hierarchy. So like I said, each session can either be HMAC, which is used both to authenticate because you've got the authentication key in there, and also to check the parameters and the response. So it's like HMAC on the Internet. It's a key hash that runs over both the command you send in and the response you get back. So you know it cannot have been altered during transmission, so it ensures the integrity of the command you actually sent in. Then you have this thing called parameter decryption. The reason it's called parameter decryption is because all of the TPM specifications are written from the point of view of the TPM. So as far as the TPM itself is concerned, it has to decrypt the parameters. You have to encrypt them, but the TPM has to decrypt them. So this is called parameter decryption, and it's also responsible for response encryption, which means the TPM encrypts the response that sends back to you, and you can then decrypt it. If you want to use HMAC for integrity and parameter decryption and response encryption, you need three sessions to your TPM command. So you have to set up three separate sessions to get all of this. Obviously, then they all use separate nonces, and they're all reasonably well-secured, and everything works in a reasonably nice manner. And like I said, therefore, each command may have up to three sessions to ensure that you can do this. And parameter and response encryption require this thing called an encrypted salt. So they require that you know the public part of the key that exists in the TPM. This wouldn't be a problem except that I did say that you must have a known public key to get there, and the TPM itself only comes with these seeds, which means that somehow you have to take a seed and get a key from it. And like I said, doing that for RSA keys takes 45 seconds. You don't want to wait that long. So one of the problems with the TPM is that the TCG is still coming out with all of these guides. So in March of 2017, they published a provisioning guide which said that an RSA storage seed key derivation key must now be present at the permanent NVRAM index at 81001 in hex. So that means that if I have a really, really recent TPM, it will actually come with the RSA version of the storage key that I can then use for public parameter encryption salting. So I don't need to run this key derivation function every time that I use the TPM. This is a great time saver. Fortunately, on all TPMs that ship before November, there is still a way of setting up this key. The only thing you really didn't know is what NVRAM index it should be at. Now we have a well-known NVRAM index. Every time you install the IBM TSS, it goes and looks in this index and says, is the RSA storage key there? If not, I will generate one and place it there. So now we actually have a guaranteed storage key we can encrypt to. Second problem of TPMs is that when you send a command in, only the first parameter of that command is encrypted. And remember, each of the commands I showed you had quite a few parameters. By the way, first parameter does not include the parent keys or any of the keys. So anything with the at sign is not included in this encryption. It's the first parameter. And there's a problem here because if you look at TPM import, it has a parent key handle, which is not the first parameter, but its first parameter are the public key parameters. You honestly don't care about encrypting those. So if I use parameter decryption with TPM import, my private key is not protected.  I don't know why they did this. The solution in my mind would have been to reverse those two parameters. But remember, these are the people who came up with the TSS we're talking about. So their solution was not to reverse these two parameters. It was to add an extra parameter called an encryption key, which would then be encrypted, and then you use this encryption key to encrypt the private key. God knows why. I suspect all they really wanted to do was make my life in constructing a crypto system much harder. So thank you very much. There it is. There are several other commands that use the IBM TSS.  But you can cope with them. And all of the stuff that I'm going to show you does cope with them. The key point about this is that all of this is incredibly complicated. The average user does not want to have to understand what I just spent the last 25 minutes telling you. So they want all of this complexity just to be hidden from them. They want the TPM in their laptop just to work for shielding private keys. So the question that I mostly was interested in, I had to learn all of this to work out how to use the TPM. But the one I'm mostly interested in is how do I enable all of you to use the TPM very simply. And the answer to that is that we actually use TPM enabling all of the crypto systems that we use today. So almost everybody understands how to use open SSL. It's complex but they pretty much understand it. Most people understand how to use GPG. Most people understand how to create a key for open VPN. So there's this sort of unfortunate complex knowledge that we all use but which can be used if I just TPM enable these crypto systems quality to use a TPM for the key handling and signature and encryption under the covers if I get it right. So that is the goal that I'm going to do. And existing crypto systems mostly use password protected key files. So mostly you have a private key file that has all of the private elements that are AES encrypted to some password that you type in when you actually use this private key. So it's actually very easy to see that these key files could contain TPM keys with the public blob and the private blob and if we use the password as the key authority we have exactly the same workflow that we had with the ordinary keys. And then as long as the crypto system recognizes the TPM key everything would actually just work. It would see a TPM key, it would ask if your password, you type your password the crypto operation would go through the TPM but everything would just work. The only thing that you've got is enhanced security because now someone runs off with your private key file unless they have access to your TPM they cannot use it. The only additional requirement in this workflow is conversion of the actual encrypted private key into its TPM form which involves a round trip through the TPM with TPM2 import. That's the only additional thing you should need to do. And obviously you need discipline around key backup. So you can convert a key to its TPM format and obviously you need to destroy the private key but you need to have kept a backup of that because once it's converted to a long lived key, a key that might outlive the TPM on your laptop you need an offline backup copy of it somewhere and this means you need better discipline around key handling. I suppose I should ask how many people in the room have the only copy of their GPG key on their laptop but I won't embarrass you by asking the question. So the advantages of all of this are now we only actually need to trust the TPM. Depending on who you believe that is actually an easy thing to do. TPMs themselves are actually manufactured by an international consortium. They are in use by a lot of the public security agencies of a lot of companies so the Russia, FSB, the Chinese security agency and the NSA will use these TPMs so they clearly trust them and as far as the manufacturers can tell there are no backdoors inserted into them so there's no real reason why you shouldn't trust them as well. In fact one of the great things about TPM 2.0 is that IBM has produced a software emulation of the TPM that you can actually run and verify that it works and if you don't trust it you can actually take the code apart and see what it's doing and see that there are actually no backdoors. Microsoft has now just released their TPM emulator as well and if you actually build one of my open SSL system when you type make test one of the things it will actually do is fire up the TPM emulator and run a load of checks against it just to make sure that what you built works. The point about this is that the key can never be stolen all it can happen is someone could snoop your password authority and if they have access to your laptop so while the laptop is switched on they could use the key to generate signatures because they then have your authority but if they just steal your key file without your TPM it's useless so this gives you the something you have and something you know security that is the hallmark of two factor authentication so by moving keys into the TPM you get two factor authentication which seems to have been pretty much the holy grail of security for a long time and apart from key conversion there should be no changes to your workflow at all these are great advantages the disadvantages are the key is tied to a single physical TPM which is part of your laptop lose your laptop or upgrade to a different laptop all the keys are useless this is unfortunate that means that you have to have a TPM backup handling and the keys have therefore to be reconverted to TPM form every time you change laptops you have more than one laptop you have to convert to TPM form on both of those laptops and TPM 2.0 does require the internal resource manager if you have a lot of keys you'll just run out of TPM memory if you try and use it with a huge number of keys without the resource manager the final thing is the TPM is slow it takes 55 seconds to do a KDF to generate RSA primes my actual laptop could have done that calculation in about 100 milliseconds so the TPM itself is a really slow processing engine so it can't process hundreds of key operations per second it's fine for sort of signatures that we only use rarely so for VPNs you know you use them once every five minutes for SSH sessions I think reauthentication rarely occurs so it doesn't really matter for GPG you only use them for signatures these are not high density operations you're not doing them hundreds of times a second but this also means that you're not going to be using a TPM for symmetric encryption of your disk unless you want your data to be available on a time span of weeks instead of seconds so the current status is that I've written and published an engine for open SSL engines of the way you actually add different key handling systems to open SSL the URL I think was also part of the stuff I submitted to FOSDAM it comes with this utility called create TPM2 key that actually converts from an open SSL key private key to a TPM private key and this utility can also be used to create a TPM private key that's actually embedded in the TPM and can never be extracted there is an issue with elliptic curves so I did say that crypto agility was one of the hallmarks of the TPM and that allowed you to use elliptic curve cryptography the problem is that TPM enabling of this all works fine but the TPMs themselves do not have generic elliptic curve key handling I've yelled at various people at the TCG to try and find out why this is and the best excuse I get back is because it's export regulations if we do generic elliptic curves we have a problem exporting the TPM to various countries you want to mandate what curves can be used and want to ban all the other curves from being used so the problem is that the TPM therefore only has a known set of curves that it can be it can be used with and right at the moment it's only two mandated curves and by mandated curves it means that the TPM must handle these there are lots of other optional curves that the TCG has parameterized but manufacturers being manufacturers you'll find that every TPM2O you have basically only supports the mandated curves and no others so you have a choice of two curves and they are the Burrito Nairing 256 which nobody uses or the NIST P256 curve which is the one the NSA has come up with and is not trusted by any other country Instantly if we were in China I'd be saying you have the Burrito Nairing 256 curve and you have the SM 256 curve which the Chinese came up with and which nobody else trusts that they can't decrypt but the point is that you have to use the mandated curves otherwise you're not transferring your private keys into the TPM and this is a bit unfortunate for a lot of us because the Bernstein curve 25519 is actually the most popular curve in open source and that's not even parameterized by the TCG so it's not even on the TCG radar but if you can live with all of these issues the only remaining problem with open SSL is that open SSL uses a different API for every key format it has so if you have a PEM key it has a PEM API for a DER key it has a DER API and for an engine key it has an engine API chances are the crypto system you're using didn't bother to actually add the engine load private key so even if I enable the use of engine private keys in open SSL often there's still a couple of lines to the open source program to get it to load the engine private key if it can't find any of the other private keys however it's easy to own a couple of lines I actually did it to open VPM and I'm just trying to get the patches up now it looks fairly simple I also did it to open SSH which is actually based in open SSL the patch to use engine keys is fairly simple the problem is that when you use the open SSH agent the way it's used to handling keys is it passes the private keys to the agent via their primes and if it's a TPM key you cannot do that because you do not know the primes so there had to be an additional patch to open SSH that actually allows the agent to work with engine keys but I have all those patches and I produce them for open SSH GnpG was not even based on open SSL so I had to look through Gcrypt and various other things to get it to work and I therefore wrote a new TPM module for it and it does key conversion via edit key with a new GpG command called key to TPM so let's demo all of this so you can actually see what I'm doing in the final five minutes I hope okay is that roughly visible to everybody yep I think so okay so I have a brand new GpG system I'm going to use so let's do a so this is just me generating a rubbish so now it's just generating for me it's going to ask me for a passphrase I'm going to type test as the passphrase which it doesn't like because it's too short you should never use test as your key passphrase apart from you doing demos by the way I should give you that warning and you can see it's created for me two RSA keys can everybody see this I know there's a bit of obscurity from the console if you can see this and in true GpG if you look in the GpG private directory let's look at the 099 key that's actually stored as an S expression for a protected private key it's an RSA key it's got the modulus and the exponent the public key and it's protected via this encryption algorithm which is the standard way that it does all of this but what I can do if I do the so this is one I've altered earlier sorry I need to tell it what name I gave it's tests wasn't it so these are my keys I've got my primary key it's used for signing and certification my encryption sub key both the RSA and both are currently just sort of sitting in encrypted form in my GpG directory so now I'm going to convert let's actually see what the grips are so the 37 key is actually my primary key what I'm going to do I'm going to put my primary key into the TPM key to TPM and it's going to ask me if I want to move the primary key I now have to give it my decryption passphrase which is test to decrypt the key and and now it's going to give me a TPM passphrase which I'm going to use as TPM which you should never use anyway either and now it will actually convert my private key I actually when I inserted this into GpG I just basically used the card API diversions so it comes back as a special card serial number saying TPM protected this now means that this RSA key which was a grip 37 is now protected and there's a slight trick to this you notice that whenever you do a key operation and quit GpG it usually asks you for confirmation didn't this time because as soon as you do key to TPM the conversion is instantaneous but if I actually look at the protected key it's the wrong one because that was my sub key but I had a 50-50 chance of getting that wrong you see the format of the key is now a shadowed private key which is the same format as you use for card keys but the shadow information actually has a TPM designation here and what's stored in the shadow information is the parent the public key blob and the private key blob so the shadowed private key is now actually storing all of the TPM information so you can still do a denial of service attack on my TPM protected GpG key by destroying this file but now you cannot steal this file from my laptop and everything is secure and I suppose one of the things I should show you is actually adding a key to this so let's say I want to actually add an encryption sub key let's do a signing sub key so let's do an elliptic curve signing sub key now it gives me a lot of choices for curves but as you know this is the only curve choice I can actually use so I will choose curve 3 because it's Hobson's choice for me and I'll give it no expiry it will ask me if this is correct yes I want to really create it yes and I need a passphrase to protect the key so I'll use test again and I also need the certification key passphrase to attach this and remember now it asked me for a TPM key passphrase because this key isn't my TPM that's the clue to the user that your key is actually TPM protected and now what you can see is I actually have a non-TPM protected secondary key that's actually used for signing and I can actually save this key but now what I can do is I can select this sub key number 2 and I can just convert this to TPM form as well so I need to give it the test passphrase to give it the TPM passphrase and now if you look I have not only a protected certification key but I also have a TPM protected signing key and I suppose and notice when I quit it doesn't ask me to confirm because that conversion is already done and if I want to sign a little text file which I did earlier but we'll overwrite it anyway it's now asking me to sign with my TPM passphrase so I type my TPM passphrase the TPM itself constructed the signature of that file and if I actually verify this you can see the verification is done using an ECDSA key that I just created and that signature was actually done through the TPM encryption operations if I TPM protect the encryption key would be done in exactly the same way I was going to demonstrate how all this works with open SSL but I think I'll do the courtesy of allowing you to ask questions before you run out of time so in the last three minutes there's any well I did have a conclusion but I won't bother does anybody have any questions about this yep so the question was when can we get the GPG patches the answer is they're already posted to the list I believe in the URLs I did for FOSDEM I might have referred to the patch but if not the GPG list is very low traffic and they were posted within the last month you can just find them there I know in the URLs for the FOSDEM session I actually pointed to my OpenSUSA build service that's actually building this version of GPG for Debian 9 OpenSUSA and Fedora 26 I think and Fedora Rawhide okay question up here what is the reconversion process if you want to transfer your key to your keys to a different GPM so what was the question what's the conversion process for transferring your keys from one GPM to another so there is no conversion process for transferring keys from one TPM to another the TPM allows for something called key duplication but for all the keys that I create the duplication policy is empty which means they can never be extracted from the TPM the problem with duplicatable keys is they can be extracted from the TPM so that means a clever attacker can cause the extraction and you've effectively lost the property of TPM protection so for your own safety I believe the best use of the TPM is actually one way conversion of the keys which means that nobody, not even you can ever get them out of TPM format okay here's the question if I run this on ARM with the trust zone feature in the CPU is it also compatible with TPM 2.0? So the question is trust zone compatible with TPM 2.0 and the answer is they're two different things so the TPM is a discrete processing module trust zone is sort of the ARM enclave technology a bit like SGX so you can use trust zone to implement a software based TPM and as long as you're willing to trust that software based TPM and you have effectively you've put the TPM emulator into the enclave something in trust zone like the TPM but by and large just if vanilla trust zone has no TPM capabilities so you require a discrete TPM to get this to function Intel actually has an interesting thing called the Intel PTT that I always forget what it means but essentially it means a TPM that runs in a ring equivalent to the management engine on the CPU which is obviously after discovering the management engine is running MINIX something you'd all trust in this room so you do have to be careful of base TPMs even in things like trust zone okay no more questions okay one more question so the question is does the kernel key ring have integration with the TPM and the answer is yes but it's not what you expect so the kernel has this concept of TPM trusted keys but it doesn't mean that it will use the TPM to do the signature operations and the encryption operations what TPM trusted keys means is that the data that forms the key is sealed to the TPM so when you use a TPM trusted key unlock it actually brings the key back in the clear from the TPM so it's not using the TPM to shield key operations in the same way that I am but it's using a TPM function to protect the keys and for instance this is used for asymmetric encryption keys so if you use LUX with TPM protection you would actually use this type of trusted sealed key and the reason you'd use it is because I can't do asymmetric encryption operations fast enough for you to actually be able to decrypt a disk so you need to get the key back then you just need to load it up into software that does the symmetric decryption so that's the way the trusted key functionality in the kernel actually works it's possible to actually develop a new trusted key functionality that would actually do the signing and decryption operations through the TPM but that doesn't currently exist in the kernel today okay and I think one more question given that we don't really know what goes on inside the TPM silicon that the spec is kind of insane and its API seems to only grow in complexity how do we trust this to keep anything safe so the question is basically how do we trust the TPM if the spec is so complicated the implementation is so complicated and the great answer to that is that the implementation is all available in open source if you trust the open source you can actually trust that your TPM is working like that the problem is how do you trust that the manufacturer of your TPM actually implemented what you see in open source and the answer is you have absolutely no guarantee of that and as you saw recently with the infineon cock up over generating primes they don't actually necessarily use the open source version that was produced so the only real security I can give you is that the TPM is just one thing and there's a lot of bounty going for discovering key bugs and security bugs and so this means that there are a lot of really clever people attempting to prove that the TPM was manufactured wrongly and will actually give up its secrets so as long as none of them has published a bug bounty you can be reasonably certain that your TPM wasn't compromised but that's about the only security you have and with that I think I better say thank you very much for the next speaker time to set up


Hello everyone, I am Maitri Mordekar from the clicker hardware team and I am going to demonstrate today how to set the demonstration for the robo control application. The very first thing that we are supposed to do is plug the router, there will be green lights glowing that a stable green light will tell us that the router is on. Now this is the spark 5, this is the robo that is going to be controlled by the Akash application, it is basically a spark 5 platform that has a Raspberry Pi connected on top of it that is interface using the ZigBee module, it has two USB ports and one is connected to the dongle that connects to the router that we showed and the other one is connected to a USB camera. Now very first thing that we have to do is mount, connect the battery protection circuit like this. Now there are four indications for the, this battery is connected to the Raspberry Pi, it passes the Raspberry Pi that is the dongle and the USB camera as well. So for this battery protection has four levels of indication of the battery. Now a stable blue light will tell us that the battery is about 7.2 volts. Now between 6.8 and 7.2 is going to blink blue, between 6.6 and 6.8 is going to blink red or below 6, 6.6 is going to give a beep sound. So the next thing we have to is plug the Raspberry Pi power, the Raspberry Pi is booting up, once the green color light here turns on that means the Raspberry Pi camera has started. Once the green line turns on that means the Raspberry Pi has started. Now we could turn the spark 5 on. Now in case the light of the battery protection circuit turns, gives a beeping sound you are supposed to turn the battery and the robot off and going to, I am supposed to put it for charging so that the battery level does not go below the minimum value. The next setup is the static camera that is going to monitor the robot so that it does not go out of the bounds or the user knows where exactly the robot stands. Now this is the setup, it is a Raspberry Pi which has the image of the operating system, it has a dongle and the USB camera. This is the camera that is going to monitor the robot. It is supposed to switch on the power supply and wait till this green line turns on. Now this setup is for the dual screen application that we have developed. In case the single screen application has to be run, there is no need for this setup. This entire setup has to be removed. There is no need to have an additional camera and an additional Raspberry Pi. Now these are the changes or settings that are supposed to be done on the tablet. First go to pi 5, turn it on and connect it to the router that we showed. The name of our router was tprobo. Now these are the settings, the password we gave was cresit123, it may be whatever password that you give and set it on the Raspberry Pi as well as the router. Go to show advance options and turn it to static, turn the IP settings to static, set the IP address. You can put any value that is above 130, so I will put it as 148 supports. On the value of the router that is <IP_ADDRESS>, again the value of the router. Save, it is going to connect to tprobo, connect it. Now you can start the application provided the camera of the static and the robo is on. However, it is possible that either of the cameras may be off, but then ensure that the camera is based on. This is the robo controller application for the dual screen. Now the settings, now since the Raspberry Pi robo camera is given IP 124, 1.125, the respective IPs are put in these sections. This is for the camera of the robo, it is for the control port, that is the control signal that are sent on 777 port of 125, the still camera is on 126 port number 6666. This is the view of the static camera and this is the view of the robo. Now using this joystick you can control the robo, that is forward, backward, left, right. Along with this we have given a servo to the camera that can change the angle of view that is up. And if you want to get back to the default settings you can press 0, with that down you can change the angle of view. You can also vary the speed, now the plus is going to move a lot faster, 0 is going to get it back to its default settings, minus is going to move very slowly, plus is faster. Now the previous application we showed was for the dual screen, now you can run the same apparatus on a single screen and you do not need the additional Raspberry Pi. This is the application, this is the robot screen and we do not have the static camera screen here. It is exactly the same procedure, but in the settings we have one option list that is for the second Raspberry Pi camera, that is 1.126 is not there. So for that everything is same, on the dual screen as well you can see just one screen of the robot, if you switch off the Raspberry Pi or the other Raspberry Pi, it is just going to show you a message saying the other Raspberry Pi camera is not on, the rest of the movement is the same for the robot.


Am I tired? You'll be glad when this day is over. I won't be long, Joe. It's pretty near time for the night shift. Come in. And they can have it. This tunnel's been at Jinx ever since we started the building. Yeah, well, every tunnel's at Jinx. You've been sand hogging long enough, y'all know that. I know, but this one's different. I can smell death around here. I can smell it. Well, I can smell that pot of gulag, my old lady's got cooking on the stove. Better come home to dinner with me, Joe. The old lady sure stirs up a mean batch of gulag. I don't like the looks of that wall over there. Water's been seeping through the cement all day. Whatever. We're under the river. Some water's bound to seep through. Yeah, but there's a crack there. Looks to me like it's been getting bigger. There's 70 hogs working down here. Yeah, if this is scared, prop it up with a timber. We'll have them throw some more cement in there in the morning. I've seen lots of them. Hey, Joe, you're right. It is breaking. Hey, guys!   She's got a blow! Laulhey, say, man, I knew that beat! An accident, not an accident! Murder! That's what I did! Dr. Danfield, student of crime psychology, has many times provided the police with a solution to a baffling crime. There's an interesting case ahead for the doctor today. We'll call it the Tunnel Smelled of Death. You want to get that, Rusty? Okay. Hello? Yes. Yes, just a minute. It's for you, then. All right, gimme. Hello? Speaking. Oh? Well, I hardly think that's exactly my line. Yes, yes, I know it was terrible. Well, let me think it over. I'll call you back. What was all that about? About that tunnel disaster, Rusty. Oh? That was the head of the Civic Betterman's League. He wanted us to do a little investigating. Are we going to? No, I don't think so. That affair smells the high heaven of graft and corruption. That's a job for the police. I doubt it would have much psychological interest. He is. But those poor families of the men who are... Yeah, I get it. Hello, Danpill speaking. No? Well, just a minute. I want to close the door. Dan, the door isn't open yet. Rusty, grab the extension of the phone. I want you to hear this. Oh, yeah. Okay, I just wanted to be sure he wouldn't be overheard. Don't make me laugh, doctor. I heard the click of that phone. Well, then I don't have to tell you that my secretary is listening in. That gags as old as the hills. Do you mind repeating what you first told me? No, not at all. I said I had word that you were asked to investigate the tunnel disaster. You must have big ears. I have ways. What I want to know is, are you going to do it? Possibly. I sincerely advise against it. Oh, you do? Yes. Forget it. It was an accident. And if I don't forget it? Look, Danpill. The death toll on that job's already 70. You and that red-headed secretary, yours, it'd make it 72. You know, I might as well hang up, Rusty, and our friend has finished his speech.  Oh, not nervous, Rusty. Doesn't take any nerve to make threats over the telephone. What are you going to do? A little investigating. This case has suddenly become very interesting. I'd like to stick a pin in that bird's superiority complex. In a moment we'll return for the second act of Danger Dr. Danpill, but first, now we'll return you to Michael Dunn for the second act of Danger Dr. Danpill. Well, I hope the zone of the mayor is receiving this afternoon, Rusty. But Dan, you don't suspect the mayor. Maybe yes, maybe no. We might as well begin at the top. Dr. Danpill. Oh, good afternoon, publisher. Rusty, do you know Grant Stevens, publisher of The Eagle? How do you do, Mr. Stevens? How do you do? Danpill, are you going in to see the mayor? I am. Good, I'm going in with you. Well, now, what I'm about to ask the mayor is probably... I know what you're here for. You're investigating a tunnel accident. Well, more people know more about my business today. And it's my business to know things. I'm running a newspaper. All right, come along. I suppose the only way to break up this racket is to give it plenty of publicity. And I'll do that. I certainly will. Let's go right in. Supposing his honor doesn't want us there to come in. Well, we'll go in all right. We'll simply have to lay off for a while or something. What's the matter, Danpill? Listen. I'm an investigation officer, and I support an investigation. Let's go right in. All right. Good afternoon, Your Honor. What is it? Why, how dare you invade the sanctity of my... Oh, good afternoon, Mr. Stevens. How do you do, publisher? Riley? Well, this is Dr. Daniel Danpill and his secretary. You should know, Mayor Riley Danpill, the other is Orson Plum, city engineer. How do you do? Dr. Danpill's here to investigate the tunnel disaster on behalf of the Civic Betterment League. Investigate the terrible disaster? Terrible. Oh, yes, ma'am. It was awful, awful. I couldn't sleep a wink last night thinking of those poor men. To say nothing of the expense to rebuild it. But why start your investigation here? Well, I've got to start somewhere. I don't think I care to answer any questions. My office carries a certain amount of immunity, you know. Well, you will answer some questions. I and the power of my newspaper put you in this office, and my newspaper and I can put you out of it. If there's corruption here in the city hall and incompetence in our engineering department, by Godfrey I want to know about it. I'll spread it over every front page of the country. I'll expose the whole dirty mess to the whole wide world. But I know absolutely nothing about the accident. Very well. Can I answer Dr. Danpill's question? Of course, of course. I'll be only too glad to assist in any way possible. Thank you, your honor. So you know nothing about the building of this tunnel. The building of the tunnel, my dear sir, is the responsibility of the city's engineering department. Now see here, your honor, you're not going to... I'll get to you in just a moment, Mr. Plum.  I'm very proud of that tunnel, Dr. Danfield. I fought for it courageously from the very beginning. Why should I want to see anything happen to my favorite project? I didn't say you did. Then why are you asking these questions? I haven't asked any yet. By the way, where were you when the accident occurred, your honor? I was out at my new country home supervising the construction of a sunroom. Oh, you have a country home? I most certainly do. A beautiful place. Cost me $60,000. $60,000? Yes.  Why? $150 for a suit of clothes? Why, I never paid more than $45 in my life. Walk upstairs, Mr. Stephen. Don't be facetious, young lady. And the diamond ring, Dan? Yes, the diamond ring, your honor. I don't have to be cataclyzed about my personal... I don't think you're going to be, your honor. For instance, how is it that a man who has a yearly salary from the taxpayers of only $8,000 can afford a $60,000 home? I have a certain investment. Plus $150 suit. Now, look, I'm not going to... And a $5,000 ring. That ring was given to me by one of my constituents. Wasn't your new country home given to you also by the Adamson Construction Company, the company that's building your new tunnel? No, no, it was not. Then where did the money come from to build your new home? What investment? Be specific. Well, I... If you don't tell me, you'll tell the FBI. That tunnel is being built with government funds. Well, the man in my position often gets gifts. Some people I'm able to do favors for. Nearly every city official does. Well, that'll make excellent reading material. But I didn't get anything from the Adamson Construction Company. And you can investigate me from here to Highwater. I doubt if you'll have to look any further, Dr. Danfield. Riley's got a guilty look of I ever saw one. The highest gift I ever received wasn't over $1,000. Looks pretty bad for his honor, Dan. Maybe. Now you, Mr. Orson Plum. Me? Yes. Up until the time of the accident, what work on the tunnel was it going along as anticipated? No, indeed. And we've been having a lot of trouble. Hit a lot of hard rock and things that we never counted on. The tunnel is going to cost $15,683,000 more than we expected. Now with this accident, it'll cost another two and a half minutes. You're pretty sure of your figures, Mr. Plum. I am. I'm a good engineer. Tell me, just how is the tunnel being constructed? Well, there are two 100-foot shafts one on each side of the river. We've been tunneling toward the center. And we'll meet exactly 3,206 feet in. The tunnel has a bore of 36 and 410 feet. And you expect that the tunnels from each side will meet exactly? According to my calculations, there won't be more than three tenths of a foot off. Mr. Plum, what in your opinion was the cause of the tunnel's collapse? I'm not prepared as yet to say. Could it possibly have been that the cement mixture was not up to specifications, or that not enough reinforcing steel had been used? No, no, no, no, no, Dr. Danfield, not that. That would make whoever was responsible liable to criminal prosecution. He'd be, uh, he'd be no less than a murderer. You're exactly right, Mr. Plum. Oh, my, this is awful. Those poor, poor men. And to think that this should happen today of all days. Oh, what's different about today? That my daughter is being brought out tonight. At least she was.  Well, that shouldn't be so hard to do. Young lady, have you ever tried to cancel 1048 invitations? Uh, plus a dance band and the casers.  Just how much is your yearly take, Mr. Plum? Huh? Uh, take? Yeah, it's a salary. Uh, 7,500. Unless withholding tax, of course. Eh, why? Brother, the truth these fellas can do on $7,000 or $8,000. Yes, for a thing. I'm afraid I'm in the wrong business. Tell me, where does your graph come from, Mr. Plum? A graph, a Dr. Danfield. That's an insult. Well, that's an insult. Either tell me or the FBI. Eh, eh, eh. I do receive a slight commission from some of the companies who do construction jobs for the city. I'll admit it's unethical. And these are the two men that I and my paper helped put into public office. Well, Danfield, I've heard enough. I'm going to put out an excerpt. The eagle will break up this gang of corrupt office holders, or my name isn't Colonel Grant Stevens. Yeah, Mr. Stevens, please don't print this in your paper. I'm not responsible for the accident. I swear it. I'll resign if you want me to, but don't, President.  Your wife?  Thank heavens I've never married. Well, Rusty, I think the next thing for us to do is go down and take a look at that tunnel. I've got a hunch that the answer to this whole thing is about a hundred feet underground. Oh, uh, care to go long, publisher? And I am the time now. I've got to get that extra out. And as for you, Riley and Plum, you can read your political epitaphs on the front page of my paper in just exactly one half an hour. Good day, gentlemen. Wow, what a stuffed shirt. An awesome looks like the gig is happening. Hey, Dr. Danville, I must beg of you. Don't go down in that tunnel. Oh, why not? It isn't safe. We pulled everybody out of there. We're only keeping the pumps going to keep the water down. Well, I think Rusty and I can take care of ourselves. I wouldn't do it, Danfield. Seventy dead men are enough. They'll use you to add in to the list. I, uh, don't think they want us to go down, Rusty. It doesn't look like it. What are we going to do? We're going down. In a moment we'll return to the third act of Danger, Dr. Danfield. But first, I'll back to Michael Dunn for the third act of Danger, Dr. Danfield. They had their long-awaited boots there. Sure wet down here. Yeah, well, it's about three inches deep. Yeah, so one of the whole river didn't come in when the walls fell. Oh, poor guy.  Like a prune. Dan, that was it. Well, the pumps are keeping it down for you, Rusty. Now, let's see. Flash the light ahead. I think we ought to be getting to the place where she came in. Yeah, there's a big pile of stuff just up ahead. Yep. Yep, this is it, all right? Say, uh, feel this chunk of cement, Rusty. Hmph. Like crumble. Just like breadcrumbs. Yes, it's indeed just as I thought. That stuff hasn't got enough cement in it to make a mud pod. Uh, flash the light up on the walls. Will you have that hole up there? Up here, Dan? Yeah. Ah, you see that, Rusty? I didn't see anything there at all. I wondered if you fell in. What did mean, Dan? Well, it means that somebody has been diverting a lot of steel and cement that should have been used in this tunnel to another operation. What other operation? Well, I believe that Mr. Stevens, in his newspaper, would call it the Black Market. I thought the Black Market was dead. Well, not in materials like steel and cement, Rusty. That stuff that's been stolen from this tunnel would probably bring over a million. Yeah, it looks bad for our engineering friends, doesn't it? Yes, and bad for the mayor, too. Rusty. Listen. I don't hear anything. Neither do I. Just the water, that's all. Would you ask me that for me? Well, because we should be hearing something. The pumps. Somebody turn them off. Come on, Rusty, we better run for it. What would anybody want to do that for? For the water running faster, I suppose. But the tunnel will fill up without the pumps going. That's about the idea, Rusty. It's up to my knees now, Dad. It keeps you just up the head there. What is getting off me deep, Dad? I know, but keep going. There's a little light just up ahead. There's a light coming down from the shaft. We're going to make it all right. Dad, the elevator. Hey, Rusty, what about it? It isn't there. What? Well, I'm sure you're right. Rusty, somebody's really got it in for us. Give me that condor. Well, it's like a couple of wraps, Rusty. What do we do, Dad? I want it up to my waist. It could be a ladder somewhere. I'll get excited. It usually isn't one of these shafts for emergencies. Yeah. Here it is. Come on, Rusty, I'll give you a... Come on. There. Come on. It looks like a long way up. Well, keep on climbing. I see I'm right behind you. I won't let you fall. I'm afraid I'll get busier. I never could stand climbing. Keep looking up. Don't look down. Who would be trying to kill him? No, I'm not sure yet, but whoever it is is in for a big surprise. Also, a good long stretch under supervised restraint. Here's the top. Pull yourself up, Rusty.  I never want to get over two inches underground again.  We better go somewhere and run ourselves through a ringer. Come on, there's a drugstore across the street. We'll go and call a cab. Just look at my nylon.   You go in and phone all the way here. Hey, just a minute. Here's Grant Stevens' extra. Let's take a look at this scoop. Just look at those headlines, Rusty. Oh, dang it. Taxi dancer shoots made over $10 bill.  Well, that's Grant Stevens' private office over there. That's Blast Inbox? Yeah. He's just about as private as a show window at Macy's. He likes to watch his employees work, I guess. Well, anyway, he didn't have a hard time telling anybody that he was out. And right now, he's in. A little bit. Well, well, now to Danfield. Mr. Price, come in. Come right here. Yeah, thanks, Stevens. Have a chair. Have a chair. Well, don't mind if we do. Eh, it's not a goldfish bowl you've got here. Well, this publishing plant's all mine, Danfield. I like Steve's run. Well, you sure got a good view, all four sides. Well, you got any news for me? I think we have. Good. The last thing I heard, you're going down to that tunnel. What did you find out? Any evidence?  Well, what do you mean by that? Somebody showed off the pumps while we were down there and took away the elevator. Well, that dirty rat. Tell me who it was and I'll blast his name from coast to coast. I'll get out an extra. Are you sure you know who it was? I'm quite sure. It could have been the mayor. Well, Mayor Riley? Why, that's ungrateful. Well, I don't think it was. No, why not? The mayor is a little man publisher.  A deal where the profits will run into millions. Without the support you gave him in your newspaper, I believe you'd be running a saloon somewhere, feeling the change from his drunken customers. You know, Danfield, I suspected that for a long time. Yeah, what a mistake I made when I gave him my support. Well, I'll rectify it. I'll see that he's gotten wet out fast.  I'm sure that he was greatly shocked over the death of those 70 men. Well, now, don't try to defend him, Danfield. As you say, a little man has no place as mayor of this city. Another thing that convinces me of his innocence in this tunnel deal, Stephen, is the way he spends his money. It's something new to him, so he brags about it and spends it like a drunken sailor. Evidence? His expensive clothes in a $60,000 estate. And his flashy diamond race. Well, you may be right, Danfield. Well, that leaves it up to Orson Plum. And George, I didn't think he was capable of such a thing. Neither did I. Well, well, why? Why he has to be. Well, let's see what kind of a chap he is, Stephen.  Yeah, Plum has all the degrees anyone could get in engineering. I listened to that before I gave him my support. I was very much impressed at the facts he had at his fingertips, Stephen, such as the exact cost of the tunnel, its length, size of bore, and so forth. Of course, he also took the money on the side, but here again, not in big amount. Well, let's still make him a thief. Perhaps, if you want to get technical. But let's lay that little matter at the feet of his wife, huh? His wife? Yes, she was ambitious. Wanted to get about in good society, give her daughter a chance for a fine marriage. Plum couldn't provide her enough for his rather small salary of $7,500. So when several construction companies offered him commissions for throwing a little work there away, he quite naturally took it. Well, I still don't see why he could have been on this tunnel deal. Because he was too good an engineer, Mr. Stevens. Orson Plum would never have allowed such a weak mixture of cement to go into a job that he was connected with. Never with his knowledge. He had too much pride in his work. By right now, I'll wager he's blaming himself for not inspecting that work more closely. And it'll be many a night before he'll be able to go to sleep without hearing the screams of those dying men and his ears. Well, it wasn't Mayor Riley or Plum who was it. Before I tell you that, publisher, and give you a chance to put out another extra, let me say that I'm positive that both the mayor and Plum know who the guilty party is. And I think with the proper handling, they can be made to tell. All right, all right. We'll come to the point, Danfield. Who is this, this super cook? You, Grant Steven. Me? Now, see here, Danfield, that's going a bit too far. Oh, is it? Why, I'll have you thrown out of here bodily. Before you do, you're going to get a bit of going over psychologically. Psychology? That's cool, boy.  You got big ideas. To you, there's only one letter in the alphabet. The letter I. In other words, you're an extrovert, a supreme egoist. What's that got to do with a keyed-in tunnel? Of the three men implicated in the tunnel deal, Steven, you're the only one capable of its conception.  And you know that I put money first. Money's the only thing worth having. Well, according to your ideas, yes. That's the reason you never married. You didn't want anyone around to spend what you made or stole. Now, see here, Danfield. You wouldn't even spend it yourself. You'd rather walk up a couple of flights to buy a cheap suit. You ride streetcars instead of taxicats.  Yes, Grant Steven, money is your one and only God. Well, supposing I do like money, that's my duty. You put Wiley and Sparman into responsible positions so that you have somebody to lord over. They made you feel as though you were actually running this city. Of course, you knew that sooner or later the poor construction work in the tunnel would be discovered. But what of it? The mayor and the city engineer were your men. They wouldn't dare to talk. A fine bit of lecturing, Dr. Danfield. But it doesn't prove a single child are carrying faith. Why, I'll public this whole interview in my paper and I'll have you laughed out of town. Oh? The courts demand physical evidence, you know, and any judge would throw all your theories out with a lot of hard work. Oh, so you want physical evidence? Well, don't you wish you had some? Take a look at this paper, Mr. Steven. What is it? That's paper that's just related to fishing for eagle? Yes, indeed. But where's the great expose of your grasping city officials? They were supposed to be in headlines, remember? There is no word in this paper about that tunnel disaster, Stevens, except a couple of paid ads in the obituary column. Put in there by a few loving widows. Well, I exchanged my mind. Oh, no, you didn't, grand Steven. You didn't even come near your newspaper office. Instead, you followed Rusty and me over to the tunnel, chef. And you made sure that when we arrived at the bottom and were well on our way, to bring up the empty case to the top and pull the switch on the pump, you didn't print that expose because you thought that the only one to know anything about the scene in the mayor's office were 100 feet deep in the ground, all covered with nice, slimy water.  Jamfield, I've got a strong arm squat around here to take care of meddlers like you. And I've got a good strong arm to take care of skunks like you. Oh, yeah? Come on, Rusty. I want to wash my hands. Quick. In a moment we'll return for the conclusion of Danger Dr. Danfield, but first, now we'll return you to Michael Dunn for the conclusion of Danger Dr. Danfield. And so, on behalf of the Civic Spectrum and League, I take great pleasure in presenting this certificate of appreciation to Dr. Daniel Danfield.  How come he's still mayor? Well, he did us a good turn by telling all of you about Grant Stevens. We present this certificate to Dr. Danfield for his great work in exposing the grass and for his great work in exposing the grass and corruption that was running rampant in our fair city. I mean, that's the certificate of mighty pretty Dan. Now, before I ask Dr. Danfield to speak, I wish to tender my resignation as mayor of this city. My health has been rather poor lately and I feel the need of travel. A little man's the last. It's great to stick it out. You ought to know I'd never tell. Dan, the city clerk is sitting right over there. I'll bet he'd give us a certificate too. Yeah, what for, let's see. A marriage certificate, you good? Now, I'd like to call on Dr. Daniel Danfield. Ladies and gentlemen, ladies and gentlemen, I've just escaped from being trapped in a tunnel. I've just escaped from being trapped in a tunnel.