Next, we will explain how the protocol can defend those
attacks:
(a)Suppose an attacker adopts the replay attack. If the
random number n is generated by a true RNG, the attacker
cannot predicate it. Then in step (iv), TPM will find the n is
illegal. Thus TPM can detect this kind of attack. Moreover,
the hardware can guarantee the security of its private key
Kpriv, and it can also prevent the Replay Attack.
(b) Suppose an attacker adopts the Tampering Attack,
then the self-measurement information SelL MeaInfo or DSR
will be tampered with. However, in step (iv), TPM will find
that the DSR is changed, because the Kpriv is strictly
protected and never exposed outside. If step (iv) passes,
TPM will find the SelLM eaInfo changes if it does the same
SHAI on SelL MeaInfo and then compares the current result
against DSR verified in step (iv).
( c) Suppose an attacker adopts the Masquerading Attack.
If step (v) also passes, then TPM will get the true
configuration of the hardware. Subsequently, TPM will
compare the hardware measurement information against the
expected one stored in SPDT in advance. Thus the