Do a TPM's benefits outweigh the risks?

Question

Is TPM really worth it?

According to Wikipedia it:

• Provides a generator of random numbers (that's okay)
• Facilities for the secure generation of cryptographic keys for limited uses (that's okay too I guess)
• Remote attestation (doesn't sound safe)

In the section at the bottom, it mentions some criticisms of TPM such as remote validation of software - manufacturer, not the user decides what can be run on the computer. This sounds scary.

Also, VeraCrypt doesn't support TPM which raises some concerns. If they don't trust it, why should I?

So is TPM worth it or is it just an unnecessary potential point of failure? Would my security and privacy be safer if I didn't use a computer with TPM at all? Full disk encryption with VeraCrypt sounds safe enough even for the most illegal use cases (NSA-proofed).

And then, would it be possible to remove the TPM module from a motherboard safely?

Answer 1

It depends on your threat model. A TPM has multiple purposes, but the most common purpose is measured boot. That is, a TPM will verify the integrity of the BIOS, option ROMs, bootloader, and other sensitive boot components so that it is able to detect an evil maid attack or modified firmware. If your threat model includes an adversary which is able to modify firmware or software on your computer, a TPM can provide tamper-evidence to ensure that it will not go undetected.

So how does a TPM work? It's actually pretty simple when you get down to it. The TPM measures the hashes of various firmware components^* and stores the hashes in registers called PCRs. If the hashes all match a known value, the TPM will unseal, allowing itself to be used to decrypt arbitrary data. What data it decrypts is up to you. Most commonly, it is part of the disk encryption key. Unless every piece of firmware and boot software has the correct hash, the TPM will not unseal and the encryption key will not be revealed. TPMs can be used for a lot more, but the idea is the same.

_{* Technically, the TPM is passive and cannot actively read firmware, bootloaders, or other data. Instead, a read-only component of the BIOS called the CRTM sends a hash of the BIOS to the TPM, starting the chain of trust. This component is read-only to ensure that a modified BIOS cannot lie to the TPM about its hash.}

So is TPM worth it or is it just an unnecessary potential point of failure? Would my security and privacy be safer if I didn't use a computer with TPM at all? Full disk encryption with VeraCrypt sounds safe enough even for the most illegal use cases (NSA-proofed).

Remote attestation is not something you will likely need to use. It is however not at all unsafe. All it does is allow a remote device to prove to the appraiser that the firmware and software it is running matches a known-good hash. It does not allow remotely controlling the machine. It is up to the OS to do the remote connections and send the data to the TPM. The TPM itself isn't even aware that it is being used for remote attestation. In fact, remote doesn't even have to mean over a network. There are very clever implementations that use a TPM to remotely attest the computer's state to a secure USB device! There are no privacy issues with a TPM's unique private key either due to a TPM's ability to sign things anonymously using DAA, or Direct Anonymous Attestation.

Let's go even further and assume the TPM is not only useless, but downright malicious. What could it do then? Well, nothing really. It lacks the ability to send the so-called LDRQ# signal over the LPC bus which is necessary to perform a DMA attack. The only thing it could do is say "everything is OK" when in reality the firmware has been tampered with. In other words, the worst a malicious TPM could do is pretend it doesn't exist, making a malicious TPM no worse than no TPM.

It is completely possible to safely remove the TPM from the motherboard. There is nothing that requires it be there. If it is not present, you will simply not be able to verify a chain of trust to be sure that firmware has not been tampered with. Note however that many modern CPUs have an integrated TPM, but it can be easily disabled, with the same results as removing the physical one. Note that some newer versions of Windows do require a TPM's presence in order to secure the boot process. If the TPM is removed, you may need to modify the OS and UEFI settings so it no longer requires it.

In the section on the bottom, it mentions some criticisms of TPM such as remote validation of software - manufacturer, not the user decides what can be run on the computer. This sounds scary.

The worry is that, in the future, manufacturers might use the TPM to prevent you from making sensitive modifications to your system. By default, TPMs will obey only its owner. If you tell a TPM that the current state of the system is known-good, it will always check to make sure the system is in that state. If an evil manufacturer sets the TPM to believe that a known-good state is one where malicious DRM and other rights-restricting software is enabled, then we have a problem. For current TPMs, it's entirely up to you to decide what software you want to run! They don't restrict your rights.

Another criticism is that it may be used to prove to remote websites that you are running the software they want you to run, or that you are using a device which is not fully under your control. The TPM can prove to the remote server that your system's firmware has not been tampered with, and if your system's firmware is designed to restrict your rights, then the TPM is proving that your rights are sufficiently curtailed and that you are allowed to watch that latest DRM-ridden video you wanted to see. Thankfully, TPMs are not currently being used to do this, but the technology is there.

The upshot is that a TPM can prove both to you locally, and to a remote server (with the OS handling the networking, of course) that your computer is in the correct state. What counts as "correct" hinges on whoever owns the TPM. If you own the TPM, then "correct" means without bootkits or other tampering. If some company owns the TPM, it means that the system's anti-piracy and DRM features are fully functional. For the TPMs in PCs you can buy today, you are the owner.

Also, VeraCrypt doesn't support TPM which raises some concerns. If they don't trust it, why should I?

VeraCrypt actually has added support for TPM version 1.2 and experimental support for TPM version 2.0 in VeraCrypt release 1.20, although they have not yet edited their documentation to reflect this. They originally were resistant because the original TrueCrypt authors did not understand the TPM. Its purpose is not to assist with disk encryption, but to verify that the firmware and important boot software (including the VeraCrypt bootloader!) have not been tampered with.

Answer 2

In the section on the bottom, it mentions some criticisms of TPM such as remote validation of software - manufacturer, not the user decides what can be run on the computer

There is a fundamental misunderstanding here.

With remote attestation, the vendor does not decide what software runs on the hardware, but rather what hardware is allowed to run their software.

Remote attestation can be very well (as in my other answer) used or abused:

• As part of a DRM system
• To block devices from certain vendors based on political criteria. This is done by whitelisting
• To implement planned obsolescence, which may be illegal in certain jurisdictions

Answer 3

Remote attestation is an optional feature.

Remote attestation requires a hardware attestation in order to work. It is currently done in iOS and Android to certify that the device is not rooted by means of certifying the bootloader is locked and enforcing Secure Boot.

There are concerns over remote attestation. These are not related by the technology itself, but from its larger use in the market.

Remote attestation cannot (easily) be used to censor software. It is just one piece of technology that requires a lot of cooperation from multiple software parts.

Remote attestation alone cannot be used from deciding whether you can run a software or not, unless it's a DRM license check. I mean, the OS decides to run applications. If the OS enforces vendor policies, and/or the software implements a framework (eg. SafetyNet) to prevent the software from running on non-certified device, that's not just the presence of the TPM.

Remote attestation is a way to enforce planned obsolescence on hardware, as old devices can be blacklisted over time. But it requires the application/OS vendor to enforce such a policy. And planed obsolescence is even illegal in certain jurisdictions like France.

Remote attestation and TPMs do not prevent developers to build their own open source tool. It does not block you from installin OSS, but perhaps you won't be able to use Netflix app on custom OS.

Answer 4

I do not trust intel's TPM at all because it's a closed source system.

I'd rather go for TrueCrypt or anything similar at any time.

I also do not agree to use a system that prevents me from quickly deploying my own boot loaders and my own OSes. Why have to have an 'approval' to be able to use them ? I just want to use them at any time on any compatible hardware.

At this point I find TPM an annoyance at most, that potentially or practically impairs my activity.

In theory you cannot remove a TPM module, but you can disable it from the BIOS/EFI. We have not tested in sufficient MBs if physically removing does harm. A colleague did physically removed a TPM module from a MSI Z68MA-G45 G3 and the MB still functioned correctly, but I am not aware if there were later implications regarding functionality.

Update

Note: Updating your BIOS can make your system lose all data if you use bitlocker encryption.

Note 2: Bitlocker is a too big fail to be worth anything.