Is there any way of recover a locked drive using TPM?

Question

Just reading I learned about the TPM technology and how it works.

However, it make me wonder... if the motherboard crashes, is the data lost forever? Because you can't use the drive in other system due to the unique RSA key used by the TPM.

Answer 1

Many TPMs will allow a backup to be stored of the key either prior to loading it on to the TPM or via some kind of export. As long as you have the key, you can reload it on a new TPM if the TPM fries.

I actually had this exact thing happen with an IBM ThinkPad with an early TPM where the TPM circuit fried and I had to replace the system board. I was able to reload the key from a backup and get the system back up and running without significant issue.

Answer 2

However, it make me wonder... if the motherboard crashes, is the data lost forever?

That depends, primarily on whether the TPM is the only storage unit for the key. TPM units contain a SEAL command, TPM_SEAL, which can be used to verify the state of the system matches that stored in the TPM before the key will be released.

However, if the key is only stored in the TPM for automatic disclosure on the basis the system has not been modified (e.g. in conjunction with Secure Boot), and it can be derived e.g. by entering a passphrase, the data is not necessarily lost. You simply need a way to get at that key.

Seal is not a key-specific command, but an authentication blob command.

The TPM itself does not contain any symmetric cryptographic operations on its coprocessor according to the latest available specification, so, the key must be handed over to the operating system for your locked drive to be decrypted. It should therefore be possible to back up this key using another format.

In general, if you do not have the keys for decrypting data, you can assume your data is lost if the algorithm was any good.