I've been doing some research on the Infineon vulnerability known as ROCA over the last few days. As I understand it, the vulnerability is present when a TPM running vulnerable firmware generates an RSA key. At that point, the public key can be used to derive the private key. My question, however, is how this affects secure boot in current versions of Windows. As far as I know, the TPM does not perform any key generation for secure boot and the secure boot keys are managed by Microsoft. Therefor, as far as the end user is concerned, ROCA isn't really relevant in the context of secure boot. Is this correct?
The RSA public key is made of two numbers N (2024 bits) and E (either 317, or commonly E = 2^16 + 1 = 65537), for the sake of performance some implementations use the small E, this implies that E=317 is vulnerable in all key sizes including 2,048-bit keys used in Secure Boot.
Check this advisory published by Microsoft (ADV170012) it lists all Microsoft's affected products.
This to say, YES in some cases ROCA could be relevant in the context of secure boot.