1

Does a TPM replace the default device's security, or add to it?

I will try to re formulate it into 2 questions, just to explain what my question is, since I am not very good at English writing.

If we take randomness as a example:


  • Does the TPM replace the device's own ability to generate its own randomness? (The randomness the device itself would have generated without the TPM)

or,

  • Does the TPM add it's randomness (thereby increasing the entropy of the device's own randomness?) to the device's default randomness?

I have searched around security stack exchange, as well as sent a mail to the company I bought the TPM from, which had no idea either. And recommended me to ask someone else. But I have not found any answers that would specifically answer if a TPM does this or not.

And, If the TPM does replace the default randomness or, key generation from the device, wouldn't that be much more insecure?

(for the risk of attacks, because of weak key generation, as stated in the Wikipedia article below) as a reference, the Wikipedia site about a TPM:

"In 2015, as part of the Snowden revelations, it was revealed that in 2010 a US CIA team claimed at an internal conference to have carried out a differential power analysis attack against TPMs that was able to extract secrets.[48][49]" - [https://en.wikipedia.org/wiki/Trusted_Platform_Module][1]

Please, if you find any errors, or that this question could be placed in another site, need clarification - do not hesitate to say that/improve my question!

I appreciate it, thank you!

2

There is no single source of randomness on a device and there is no single way to create randomness, i.e. it is specific to the OS and maybe the OS version and maybe the OS configuration and maybe even the specific application. See for example TPM to feed random number generator for how to add (not replace) the TPM random generator as a source for randomness provided by /dev/random in Linux.

4
  • Clarification; When you say "There is no single source" and "single way" you mean, literally not 1 alone-source that could provide randomness? (Isn't the NSSRANDFILE (as a side-example) a "1 source" of randomness? developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/Reference/… "Uses this file to seed the Pseudo Random Number Generator." Thanks! – William Martens Sep 26 '20 at 21:02
  • 2
    @WilliamMartens: What is available as source for randomness depends on the OS. What is used as source for randomness depends on the application - which might use like /dev/random in Linux but might also use something else. What feeds the system-wide randomness pool depends on the OS, OS version and OS configuration. – Steffen Ullrich Sep 26 '20 at 21:05
  • For the sake of details (only), is that for all TPMS or is it for any specific TPM? also, does the bios make a difference, or that's maybe depending on the hardware itself / or in itself maybe is a different question, anyway- thanks for the help It's anyway much clearer now, thanks! – William Martens Sep 27 '20 at 8:22
  • 3
    @WilliamMartens: This is not specific to a TPM but specific to the OS. – Steffen Ullrich Sep 27 '20 at 8:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.