8

Is TPM really worth it?

According to Wikipedia it:

  • Provides a generator of random numbers (that's okay)
  • Facilities for the secure generation of cryptographic keys for limited uses (that's okay too I guess)
  • Remote attestation (doesn't sound safe)

In the section on the bottom, it mentions some criticisms of TPM such as remote validation of software - manufacturer, not the user decides what can be run on the computer. This sounds scary.

Also, VeraCrypt doesn't support TPM which raises some concerns. If they don't trust it, why should I?

So is TPM worth it or is it just an unnecessary potential point of failure? Would my security and privacy be safer if I didn't use a computer with TPM at all? Full disk encryption with VeraCrypt sounds safe enough even for the most illegal use cases (NSA-proofed).

And then, would it be possible to remove the TPM module from a motherboard safely?

  • 3
    @Gillian It seems likely the TrueCrypt authors didn't understand what a TPM is for. It is not redundant and fundamentally cannot be made redundant in software. It is something that can only work in hardware. That is likely why VeraCrypt decided to add support recently to their beta builds, since they seem to have a better understanding of security. – forest Jun 15 '18 at 13:36
  • 2
    This isn't an answer, but definitely something to be aware off. I recently went through a bit of a nightmare with this. When I got my Dell XPS (about 18 months ago), I naturally enabled BitLocker which uses the TPM. This was fine, until about a week ago, I was prompted to update the BIOS, which I just did. From that point on, my Hard Drive was encrypted, and I never noted down the recovery key! I lost everything on there (happily, I had pretty much everything backed up), but still, be warned. You need to turn it off when updating your BIOS! And some might argue, that would defeat the point? – JMK Jun 15 '18 at 19:11
  • Bitlocker is junk, proven several times: engadget.com/2018/11/06/… ; but looks like some people prefer to add "-" to an answer rather than examining the situation as a whole. – Overmind Feb 1 '19 at 7:15
13

It depends on your threat model. A TPM has multiple purposes, but the most common purpose is measured boot. That is, a TPM will verify the integrity of the BIOS, option ROMs, bootloader, and other sensitive boot components so that it is able to detect an evil maid attack or modified firmware. If your threat model includes an adversary which is able to modify firmware or software on your computer, a TPM can provide tamper-evidence to ensure that it will not go undetected.

So how does a TPM work? It's actually pretty simple when you get down to it. The TPM measures the hashes of various firmware components* and stores the hashes in registers called PCRs. If the hashes all match a known value, the TPM will unseal, allowing itself to be used to decrypt arbitrary data. What data it decrypts is up to you. Most commonly, it is part of the disk encryption key. Unless every piece of firmware and boot software has the correct hash, the TPM will not unseal and the encryption key will not be revealed. TPMs can be used for a lot more, but the idea is the same.

* Technically, the TPM is passive and cannot actively read firmware, bootloaders, or other data. Instead, a read-only component of the BIOS called the CRTM sends a hash of the BIOS to the TPM, starting the chain of trust. This component is read-only to ensure that a modified BIOS cannot lie to the TPM about its hash.

So is TPM worth it or is it just an unnecessary potential point of failure? Would my security and privacy be safer if I didn't use a computer with TPM at all? Full disk encryption with VeraCrypt sounds safe enough even for the most illegal use cases (NSA-proofed).

Remote attestation is not something you will likely need to use. It is however not at all unsafe. All it does is allow a remote device to prove to the appraiser that the firmware and software it is running matches a known-good hash. It does not allow remotely controlling the machine. It is up to the OS to do the remote connections and send the data to the TPM. The TPM itself isn't even aware that it is being used for remote attestation. In fact, remote doesn't even have to mean over a network. There are very clever implementations that use a TPM to remotely attest the computer's state to a secure USB device! There are no privacy issues with a TPM's unique private key either due to a TPM's ability to sign things anonymously using DAA, or Direct Anonymous Attestation.

Let's go even further and assume the TPM is not only useless, but downright malicious. What could it do then? Well, nothing really. It lacks the ability to send the so-called LDRQ# signal over the LPC bus which is necessary to perform a DMA attack. The only thing it could do is say "everything is OK" when in reality the firmware has been tampered with. In other words, the worst a malicious TPM could do is pretend it doesn't exist, making a malicious TPM no worse than no TPM.

It is completely possible to safely remove the TPM from the motherboard. There is nothing that requires it be there. If it is not present, you will simply not be able to verify a chain of trust to be sure that firmware has not been tampered with. Note however that many modern CPUs have an integrated TPM, but it can be easily disabled, with the same results as removing the physical one. Note that some newer versions of Windows do require a TPM's presence in order to secure the boot process. If the TPM is removed, you may need to modify the OS and UEFI settings so it no longer requires a TPM.

In the section on the bottom, it mentions some criticisms of TPM such as remote validation of software - manufacturer, not the user decides what can be run on the computer. This sounds scary.

The worry is that, in the future, manufacturers might use the TPM to prevent you from making sensitive modifications to your system. By default, TPMs will obey only its owner. If you tell a TPM that the current state of the system is known-good, it will always check to make sure the system is in that state. If an evil manufacturer sets the TPM to believe that a known-good state is one where malicious DRM and other rights-restricting software is enabled, then we have a problem. For current TPMs, it's entirely up to you to decide what software you want to run! They don't restrict your rights.

Another criticism is that it may be used to prove to remote websites that you are running the software they want you to run, or that you are using a device which is not fully under your control. The TPM can prove to the remote server that your system's firmware has not been tampered with, and if your system's firmware is designed to restrict your rights, then the TPM is proving that your rights are sufficiently curtailed and that you are allowed to watch that latest DRM-ridden video you wanted to see. Thankfully, TPMs are not currently being used to do this, but the technology is there.

The overreaching issue is that a TPM can prove both to you locally, and to a remote server (with the OS handling the networking, of course) that your computer is in the correct state. What counts as "correct" hinges on whoever owns the TPM. If you own the TPM, then "correct" means without bootkits or other tampering. If some company owns the TPM, it means that the system's anti-piracy and DRM features are fully functional. For the TPMs in PCs you can buy today, you are the owner.

Also, VeraCrypt doesn't support TPM which raises some concerns. If they don't trust it, why should I?

VeraCrypt actually has added support for TPM version 1.2 and experimental support for TPM version 2.0 in VeraCrypt release 1.20, although they have not yet edited their documentation to reflect this. They originally were resistant because the original TrueCrypt authors did not understand the TPM. Its purpose is not to assist with disk encryption, but to verify that the firmware and important boot software (including the VeraCrypt bootloader!) have not been tampered with.

  • Thank you. Is it true that there don't exist any attacks executed with physical access to the device with TPM? – Gillian Jun 15 '18 at 15:39
  • 1
    @Gillian What do you mean? A TPM can only detect modified firmware. It can't protect from other physical attacks like a hardware keylogger. – forest Jun 15 '18 at 16:15
  • Then I fail to see the point of TPM. If you can modify the firmware, why can't you solder a keylogger on the device too? – Gillian Jun 15 '18 at 16:20
  • Do you get what I mean? If you have the means to execute an attack from which TPM can protect you, you implicitly have the means to execute a different kind of attack from which TPM can't protect you. – Gillian Jun 15 '18 at 16:23
  • 1
    @Gillian Because malicious software may modify firmware (e.g. a rootkit)! – forest Jun 15 '18 at 16:29
-6

I do not trust intel's TPM at all because it's a closed source system.

I'd rather go for TrueCrypt or anything similar at any time.

I also do not agree to use a system that prevents me from quickly deploying my own boot loaders and my own OSes. Why have to have an 'approval' to be able to use them ? I just want to use them at any time on any compatible hardware.

At this point I find TPM an annoyance at most, that potentially or practically impairs my activity.

In theory you cannot remove a TPM module, but you can disable it from the BIOS/EFI. We have not tested in sufficient MBs if physically removing does harm. A colleague did physically removed a TPM module from a MSI Z68MA-G45 G3 and the MB still functioned correctly, but I am not aware if there were later implications regarding functionality.

Update

Note: Updating your BIOS can make your system lose all data if you use bitlocker encryption.

Note 2: Bitlocker is a too big fail to be worth anything.

  • 7
    You have completely misunderstood what a TPM does and what it is for. It in no way whatsoever prevents you from using your own bootloader or OS. Secure boot/BootGuard != TPM. Also, comparing TrueCrypt and a TPM is comparing apples to orangutans. And why in the world would removing a TPM cause harm? It's literally a passive device. – forest Jun 15 '18 at 12:50
  • Still, if it's soldered on the MB there's a risk to it. – Overmind Jun 19 '18 at 5:20
  • Are TPMs ever actually soldered to the board? This might be the case for very compact laptops or embedded devices, but traditional computers have it plugged into the LPC bus and it is fully removable. On systems where it is soldered on (or epoxied on), the only way you could damage the system by removing it is if you do so incorrectly and end up breaking something. An amateur might break something even if it is removable, simply by damaging sensitive components when rummaging around in the guts of the computer. But is its absence alone dangerous? Not at all. – forest Jun 19 '18 at 5:24
  • Well removing it worked without consequences on the test board I mentioned so your statement is supported. – Overmind Jun 19 '18 at 5:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.