This question is about the use of a TPM by a password manager used by an end-user on a PC to store and use passwords to log in to web sites and other things that are protected only by a password.
Windows 11 requires at least TPM 2.0. Support for Windows 10 is scheduled to end in 2025. This suggests that sometime soon password managers might be able to assume the existence of TPMs on Windows workstations.
The technical details of the use of the TPM by password managers seems to be rather vague. The 1password whitepaper contains this gem, for example:
On the other hand, the 1password Windows desktop application does seem to make use of the TPM when it's available:
If you use the Trusted Platform Module with Windows Hello:
- 1Password delegates the responsibility of authentication to Windows Hello.
- The encrypted secret is stored in the Trusted Platform Module instead of your computer’s memory.
- Windows Hello can immediately unlock 1Password after you quit the app or restart your PC.
Unfortunately the above are the clearest statements I have found about any password manager's use of the TPM. My intuition is that a properly-designed Windows password manager application (or browser, browser extension, etc) could mitigate some risks using a TPM that would not otherwise be possible.
- What threats could, in principle, be mitigated by a password manager's use of a TPM that could not otherwise be mitigated?
- Are there any password managers that includes in their official security model documentation how they use the TPM?