I've been asked to improve the security of my company's iot device, and encrypt a storage partition. It's a general purpose arm based device, and currently can boot from a variety of sources (USB, network, sd card, etc).

The company wants to add a TPM chip to perform the partition encryption.

Am I right in thinking that a system lacking secure boot, that can boot whatever OS the user wants via network boot for example, could never be secure? I imagine the network booted OS could ask the TPM chip to decrypt the encrypted partition, showing that there's little actual security on this system.

Finally, if there's a uboot variant that uses a TPM chip to implement secure boot such as sboot, is that actually secure? I can't help but think that a system that allows any bootloader to run, would allow any security mechanism to be reverse engineered given enough time.

  • AFAIK secure boot is still secure as long as the first bootloader is secure - even if you can load alternative bootloaders, the TPM won't release its keys
    – user253751
    Apr 8 at 11:41
  • No the TPM 2.0 chip (using a 2.0 enabled driver) wouldn't release the keys, but I imagine I could still decrypt the encrypted partition? If the key is randomised on each device, the key isn't hugely important.
    – Alex
    Apr 8 at 12:39
  • 1
    How would you decrypt the partition without the encryption key???
    – user253751
    Apr 8 at 12:45
  • @Alex What you're saying doesn't make a whole lot of sense. You need the key in order to decrypt the data.
    – MechMK1
    Apr 8 at 15:55
  • The key, which is stored in the TPM and isn't supposedly retrievable, is used by the TPM to decrypt the partition. I assume that if there's no method of securing the system communicating with the TPM, then a TPM can be instructed to do whatever is asked of it, including decrypting a partition. Looking into this further, the TPM chip should be setup to measure the boot process, to verify the system that it's communicating with hasn't been modified.
    – Alex
    Apr 8 at 22:02

1 Answer 1


Without authenticated boot, a TPM which blindly decrypts a partition can be commanded to do so and the partitions contents dumped by the custom bootloader to disk.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.