Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Just reading I learned about the TPM technology and how it works.

However, it make me wonder... if the motherboard crashes, is the data lost forever? Because you can't use the drive in other system due to the unique RSA key used by the TPM.

share|improve this question
add comment

2 Answers

up vote 4 down vote accepted

Many TPMs will allow a backup to be stored of the key either prior to loading it on to the TPM or via some kind of export. As long as you have the key, you can reload it on a new TPM if the TPM fries.

I actually had this exact thing happen with an IBM ThinkPad with an early TPM where the TPM circuit fried and I had to replace the system board. I was able to reload the key from a backup and get the system back up and running without significant issue.

share|improve this answer
add comment

However, it make me wonder... if the motherboard crashes, is the data lost forever?

That depends, primarily on whether the TPM is the only storage unit for the key. TPM units contain a SEAL command, TPM_SEAL, which can be used to verify the state of the system matches that stored in the TPM before the key will be released.

However, if the key is only stored in the TPM for automatic disclosure on the basis the system has not been modified (e.g. in conjunction with Secure Boot), and it can be derived e.g. by entering a passphrase, the data is not necessarily lost. You simply need a way to get at that key.

Seal is not a key-specific command, but an authentication blob command.

The TPM itself does not contain any symmetric cryptographic operations on its coprocessor according to the latest available specification, so, the key must be handed over to the operating system for your locked drive to be decrypted. It should therefore be possible to back up this key using another format.

In general, if you do not have the keys for decrypting data, you can assume your data is lost if the algorithm was any good.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.