I intend to add a TPM chip to my computer’s motherboard to enable Bitlocker encryption for Windows 10. I purchased the chip online, and I’m curious if there would theoretically be any security risk if anyone had access to the chip before I received it. Does each chip contain any information such as unique keys by default which would be a risk if someone initially had access to it?
Add a comment
|
1 Answer
It would not be a risk. A TPM contains an Endorsement Key, or EK, which is used similarly to the web's PKI to certify a device as genuine and compliant with the TCG standard. They could not modify it or provide you with a new and malicious TPM unless they had the private key for the EK. This private key is not given out to the public anymore than root certificates for CAs are. The EK is unique for each device, but this is not a security risk. All they can do by knowing the EK is verify that the TPM is indeed genuine, the same way you can.
The TPM lies on the LPC bus, however it cannot use the LDRQ# line which is required to become bus master and mount a DMA attack. Because of this, even a malicious TPM is harmless.
