I see that there is an increasing number of PCs shipped with firmware based TPM (fTPM), e.g. the Intel NUC.

As far as I understand, these solutions practically emulate a TPM chip using the CPUs special instructions (ARM TrustZone or Intel SGX). This makes fTPM a cheaper and more simple solution, since there is no need for another chip in the system.

However, discrete TPM chips have some degree of protection against physical attacks, but I don't see how is this possible with current fTPM implementations.

For example in this paper on the subject, the authors explicitly state, that this form of attack was not considered:

[...] However, we do not defend against power analysis or other sidechannel attacks that require physical access to hardware or hardware modifications.

That paper also lists a number of shortcomings for an Intel SGX based approach. Are these limitations addressed by later development? Platform Trust Technology (PTT), maybe?

Or am I missing something, and the private keys generated by the fTPM cannot be read even with physical access?

  • 1
    Many motherboards with a hardware TPM are also vulnerable to physical attacks. Even if the TPM itself is hardened — which AFAIK many aren't — the bus between the CPU and the TPM usually isn't, so even if the attacker can't extract the key from the TPM, they can make it believe that the CPU is in a good state and make the TPM sign stuff. – Gilles 'SO- stop being evil' Feb 26 '17 at 18:01
  • @Gilles this question is more about possible offline attacks against fTPM implementations, and not about comparison of software and hardware TPM implementations. – KovBal May 28 '17 at 16:37

Every software implementation is weaker than the hardware one. If a real chip for tpm is done to be resistant to even physical tampering, the CPU is a general purpose chip and can be easily traced

  • 5
    A software implementation is not necessarily weaker, than a hardware one. Bad solutions exists in both software and hardware. Do you have any source that claims that an fTPM solution is not resistant to this form of attack? – KovBal Dec 29 '16 at 13:06
  • I used to see and apply an in-place debuggers, like Periscope back in old 90-s, this debugger takes out your entire CPU chip and sockets itself in it's place, the CPU chip is placed on it's board. A very useful device, and I'm seriously doubting that it has no successors. In case of using such a devices everything your CPU does is traced, so the software TPM keys can be sniffed too. In hardware TPM the chip itself is made to be resistant to key extraction out of it. I don't claim that HW is always better than SW, but this case SW lacks a HW built-in security, I think – Alexey Vesnin Dec 29 '16 at 13:43
  • 2
    @AlexeyVesnin OP mentions TrustZone and SGX, which are not normal instructions you can emulate. They provide a simple but still HW-based root-of-trust the TPM firmware can be buily upon. In other words, an fTPM is not purely done in software. – SquareRootOfTwentyThree Dec 31 '16 at 15:27
  • 6
    SGX and several TZ implementation encrypt the memory bus: wiretapping does not lead any information. As a matter of fact, this potentially makes them more secure than having TPM implemented via a separate chip on the motherboard. – SquareRootOfTwentyThree Jan 3 '17 at 11:57
  • 1
    What do you mean "can easily be traced"? This makes no sense. Not to mention, a dTPM (especially pre-1.2) is vulnerable to platform reset attacks, which do not affect fTPM. – forest Nov 29 '17 at 18:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.