Timeline for What makes TPM "trusted"?
Current License: CC BY-SA 4.0
7 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 28, 2023 at 21:58 | review | Suggested edits | |||
| Aug 3, 2023 at 11:49 | |||||
| May 11, 2023 at 14:24 | comment | added | Bruno Rohée | "who watches the watchmen?". The one doing the certifications are accredited laboratories, which means they are subjects to regular audit (see csrc.nist.gov/projects/cryptographic-module-validation-program), in the US the accrediting body is NVLAP (nist.gov/nvlap). Basically to ensure you get a malicious certified you need to corrupt manufacturer, laboratory and accrediting body, which is way too many to keep it secret. Better to try to hide it and hope the lab misses it, which is a more likely scenario, plenty of vulns have been found in certified hardware and software. | |
| Jul 20, 2022 at 13:40 | comment | added | doneal24 | @ArchimedesTrajano Next level. How would you verify trust in the technical program that verifies TPM? | |
| Jul 20, 2022 at 3:51 | comment | added | Archimedes Trajano | So in essence there's no technical way of ensuring trust. Only through certifications. Which then someone may go "who watches the watchmen?" But I think this is the best we can go with. | |
| Jul 20, 2022 at 3:49 | vote | accept | Archimedes Trajano | ||
| S Jul 20, 2022 at 3:17 | review | First answers | |||
| Jul 20, 2022 at 8:45 | |||||
| S Jul 20, 2022 at 3:17 | history | answered | Manjula | CC BY-SA 4.0 |