3

I'm trying to set secure Trusted Platform Module (TPM) passwords on a network and would like to set it to the maximum length possible.

How long can the TPM's password be? Is it limited by bits or by characters? Does anyone has information about this?

EDIT: Yes, it's TPM 2.0 modules, embedded on Dell laptops and desktops mostly.It seems that it can be longer than 32 characters but I'm unsure about the (desired) max length. I'm thinking about using a random generator to set up the passwords. Right now I used the Windows' standard password generator for Bitlock.

I do not know much about this, my idea was to set a very secure TPM (and seldom change it) and change the PIN of bitlock protection more frequently.

  • Since TPMs are hardware cryptoprocessors, I suspect it depends on the type of TPM you're using. Do you know what types of TPM modules are installed in the computers? – Steven Volckaert Jun 5 '14 at 5:56
  • Not really, from a TPM point of view (not the application using it) it's not manufacturer dependent as it's defined by TCG specs - as describe in my answer. – northox Mar 4 '15 at 21:24
3

The TCG spec doesn't impose any characters limit for the SRK and owner passwords as they are processed as hash values. Briefly, this means that for whatever password length, e.g. with TPM 1.2 it will always end up as 20Bytes/160bits (i.e. SHA1 hash).

In reality, the command line tool or the GUI you're using might add some limitations, e.g. the GTK GUI impose a 255 characters limitation on the password field.

  • 1
    As he is using TPM 2.0, the hash functions may be another function than SHA-1 (and should!), TPM 2.0 specs allow other functions such as SHA-2 (224bits/28 bytes, 256bits/32bytes, 384bits/48bytes, 512bits/64bytes) or SM3_256. – Damien Jul 4 '16 at 15:28
  • It doesn't change the answer. A hash function doesn't impose a limit on what's to be hashed. Using a better hashing function simply provide better quality (e.g. less collision). – northox Jul 4 '16 at 15:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.