Does a TPM replace the default device's security, or add to it?

Question

Does a TPM replace the default device's security, or add to it?

I will try to re formulate it into 2 questions, just to explain what my question is, since I am not very good at English writing.

If we take randomness as a example:

---

• Does the TPM replace the device's own ability to generate its own randomness? (The randomness the device itself would have generated without the TPM)

---

or,

• Does the TPM add it's randomness (thereby increasing the entropy of the device's own randomness?) to the device's default randomness?

---

I have searched around security stack exchange, as well as sent a mail to the company I bought the TPM from, which had no idea either. And recommended me to ask someone else. But I have not found any answers that would specifically answer if a TPM does this or not.

And, If the TPM does replace the default randomness or, key generation from the device, wouldn't that be much more insecure?

(for the risk of attacks, because of weak key generation, as stated in the Wikipedia article below) as a reference, the Wikipedia site about a TPM:

"In 2015, as part of the Snowden revelations, it was revealed that in 2010 a US CIA team claimed at an internal conference to have carried out a differential power analysis attack against TPMs that was able to extract secrets.[48][49]" - [https://en.wikipedia.org/wiki/Trusted_Platform_Module][1]

Please, if you find any errors, or that this question could be placed in another site, need clarification - do not hesitate to say that/improve my question!

I appreciate it, thank you!

Answer 1

There is no single source of randomness on a device and there is no single way to create randomness, i.e. it is specific to the OS and maybe the OS version and maybe the OS configuration and maybe even the specific application. See for example TPM to feed random number generator for how to add (not replace) the TPM random generator as a source for randomness provided by /dev/random in Linux.