TPM is a fantastic addition to motherboards. But I have read here some bitlocker papers and they tell me that if you choose TPM + PIN protection, then the PIN does not become part of the key, it is simply used by the chip as an additional security measure. When I understood this thing, I got stunned, because it doesn't make sense to me, it would have been much safer and much easier to implement, to use the PIN as part of the key or to encrypt the key saved in the TPM with the hash of the PIN. In fact, since the TPM is only a physical solution, attacks have been made against it and the fact that it is protected by a PIN or not, if the chip is broken, for example, with a good electron microscope, is irrelevant. While with the implementation I said before, which is apparently the most logical (correct me if I'm wrong), there is a protection based on mathematics plus TPM helps for keyloggers and rootkits. I understand that normally the TPM + PIN is used for enemies like thieves etc ... where it is more than enough. But as I said before, nothing would change for the end user, it would be easier to implement, and safer, therefore also suitable for other purposes. So why was this choice made?

Are there alternatives to bitlocker that use the method described by me? I have seen that LUKS and veracrypt still have very limited support for the chip, therefore still far from using the PIN at the same time.

  • If you reference in your question that you read something somewhere, it's beneficial to include that source. It may be that this is an untrustworthy source, or the source may include an explanation already. – MechMK1 Jun 2 at 19:57
  • @MechMK1It is written everywhere, from Microsoft presentations to stackexchange answers. – J. Doe Jun 2 at 20:04
  • I suggest to clarify what "key" you mean and where it is stored, and to read this brief explanation by Microsoft. – Enos D'Andrea Jun 2 at 20:12
  • @EnosD'Andrea With key I mean the key stored into the TPM required to decrypt the drive. – J. Doe Jun 2 at 20:18
  • channel9.msdn.com/Events/TechEd/NorthAmerica/2014/… here is said that with PIN it is performed a simple check opposed to USB key where a part of the master key is in the USB, so it is impossible to decrypt the drive without the USB, even if you break the TPM. – J. Doe Jun 2 at 20:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.