Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [tpm]

A Trusted Platform Module (TPM) is a secure coprocessor found in some x86-based computers that provides cryptographic operations and system integrity measurements.

2
votes
1answer
31 views

Can a TPM chip check if the bios is still in it's factory setting?

Can TPM (trusted platform module) be used to verify if a used laptop's bios, the bootloader and related components have not been tampered with in the past, i. e. whether those components are still in ...
0
votes
0answers
45 views

TPM, Key attestation

I need to run .exe on client machine, which will create key pair within TPM. And then I will create CSR with public key part of key pair generated by TPM. My concerns are how do i ensure that keys ...
0
votes
0answers
43 views

TPM, private key storage?

Can someone clarify me this… Some say that private keys can't be stored on TPM but how then Microsoft Virtual Smart card works? A virtual smart card appears to applications as a conventional smart ...
5
votes
0answers
35 views

Difference between Secure Boot and Attestation

What's the exact difference between secure boot and device attestation. Nowadays with secure devices both are used, even at the same time, when in the core they do similar things, which is ...
1
vote
1answer
41 views

FIDO2 on Windows: Why do I need a TPM?

I just installed the Windows 10 1809 update, which includes support for FIDO2 passwordless sign-in. I own a Yubikey 5, which supports this standard. However, I am not able to set up Windows Hello, a ...
1
vote
0answers
11 views

Can I prove the relation between AIK and EK without asking to the TPM 2.0?

The Endorsement Key (EK), the Public part, is available directly on the TPM chip, I know that you can generate an AIK key and then sign with that key, the hash must be generated by the TPM. The idea ...
0
votes
0answers
23 views

TPM 2.0 Reissue EK Cert

Unlike the TPM 1.2 module, the TPM 2.0 specification allows the platform user to create own EK (Endorsement Key) using EPS (Endorsement Primary Seed) and EKTemplate and obtain a certificate signed by ...
0
votes
0answers
33 views

TPM - store signing key and reuse it later

I am trying to use the TPM on a windows 10 platform for certificate based authentication. After struggling a little bit with the TSS.MSR code I successfully managed to create a signing key and use ...
1
vote
0answers
26 views

TPM and remote attestation

I am currently trying to figure out just how remote attestation for a TPM works in combination with the PCR-values. Is it true that the PCR values are only measured on system boot and cannot be ...
1
vote
1answer
56 views

How to protect devices that are reliant on Bitlocker and a password without TPM?

In working with a number of non-profit organizations, devices such as laptops used by staff are encrypted using Bitlocker. Unfortunately since the devices (often donated) do not feature TPM, Bitlocker ...
1
vote
1answer
33 views

Validate individual hardware components process

UFEI Secure Boot does not validate individual hardware components (SSD/hard drive, networking chips/card, video card, etc.) that can get infected. Is there anything currently available that's able to ...
0
votes
0answers
12 views

UFEI Secure Boot and TPM [duplicate]

UFEI uses TPM to form a root of trust but what software and hardware is included in UFEI Secure Boot chain of trust? Is the network card, motherboard and other parts that malware can infect included? ...
0
votes
0answers
48 views

Does using a 256 bit BitLocker key give you closer integration with hardware?

Reading TrueCrypt vs BitLocker I found the following line in the answer of user71148: Switch to 256-bit BEFORE encrypting your hard drive. Once you do that, BitLocker is safer for boot partition ...
2
votes
0answers
90 views

Use TPM2.0 to securely decrypt the hard drive in Linux — unattended

I already spent several days trying to figure out how to securely decrypt a hard drive on remote location using TPM2.0 in Linux. I'm no security expert and this is my first battle with TPM2.0. I ...
1
vote
0answers
40 views

With TPM how are the initial PCR values seeded with 'good' values?

I am trying to learn more about trusted boot / trusted platform modules and I understand about platform configuration values being a measurement of a 'good' configuration signed by a key locked from ...
2
votes
1answer
113 views

Is a TPM which boots a full-disk-encrypted computer to login secure?

Currently the laptops in use are encrypted using Pre-Boot-Authentication, so the entire disk is encrypted. A user has to enter a password before booting the operating system. A new concept suggests ...
2
votes
1answer
109 views

For a “normal” computer user, does it make a difference to have a good entropy source?

Let's take, for example, Linux. From my understanding, there are different sources and different ways that can be used to gather entropy (RNG daemon, Intel rrandr, TPM, etc). Some produce entropy that ...
0
votes
0answers
76 views

How common are computers with a TPM

When writing software, is it worth targeting a TPM for increased security? That boils down to: how common are normal business desktop and laptop computers with a TPM (not servers, not so interested ...
2
votes
0answers
52 views

TPM - Device Softwareupdate - What happens to my sealed key?

Imagine having a device that has a TPM (Trusted Platform Module). This TPM is used to store keys. Some of these keys are sealed to PCR constraints, meaning that they can only be opened if the PCRs ...
6
votes
3answers
505 views

How does Bitlocker + TPM prevent me seeing the HDD contents with another OS?

I've googled the heck out of this, and have read multiple related questions on this site, but I'm still missing a crucial piece of the puzzle. I have a (work) laptop with Win10 Pro which is encrypted ...
0
votes
0answers
95 views

Can Yubikey complement a TPM chip?

Does the functionality of an external hardware key overlaps 100% with the one provided by an embedded security chip on a laptop? Or can they complement each other? Although I assume an external key ...
2
votes
1answer
267 views

What is the safest way to use Bitlocker with TPM?

I started using bitlocker yesterday and I have a TPM2.0 in my laptop. I enabled the option to enter a pin when starting and I enabled the option to use AES256 before encrypting. I don't really ...
2
votes
0answers
290 views

Use TPM 1.2 to store the private key of a certificate

Let's say I have an application that requires certificates (HTTPS, MQTTs, etc.) due to the use of TLS. I'm planning to build my own tier-1 PKI hierarchy with my own company CA signing device ...
4
votes
1answer
195 views

How does full memory encryption in newer processes protect against DMA attacks?

Upcoming Intel CPUs have TME, current AMD processors have SME. These are full-memory encryption techniques to protect against physical attacks such as cold boot attacks. Both support encrypting the ...
1
vote
0answers
78 views

Are Authentication and Attestation two different process?

I'm a little bit unclear reading this from an article A TPM can also be used to store platform measurements that help ensure that the platform remains trustworthy. Authentication (ensuring ...
1
vote
1answer
93 views

How can a Trusted Platform Module “enhance network security”?

I've recently bought a motherboard, which has support for a Trusted Platform Module. On the topic, the manual states the following: This connector supports Trusted Platform Module (TPM) system, ...
5
votes
2answers
436 views

Does a TPM's benefits outweigh the risks?

Is TPM really worth it? According to Wikipedia it: Provides a generator of random numbers (that's okay) Facilities for the secure generation of cryptographic keys for limited uses (that's okay too I ...
1
vote
0answers
33 views

TPM and trust in cloud provider [closed]

I'm kinda unclear and confused ,i'm searching on the subject of trusted module platform and i can resume the main tpm's functions are: authentication functions, integrity measurement functions and ...
0
votes
0answers
68 views

TPM and the secret key

It's written that the TPM never allows these private keys to be exported outside the chip. This means that the only way to sign something with one of those keys is to use the computer to send a ...
1
vote
1answer
85 views

TPM with the three main groups of functions

I’m a little unclear on this (marked strong): "The public key authentication functions provide for on-chip key pair generation using a hardware random number generator, along with public key ...
5
votes
1answer
185 views

What use does a TPM have for accurate timekeeping?

I stumbled across this image and something immediately stood out to me. This is a photograph of a discrete TPM card. That silver cylinder on the left is a crystal oscillator, used to tell time with ...
0
votes
1answer
118 views

How does the TPM provide security for the cloud?

The primary scope of TPM is to assure the integrity of a platform. In this context, "integrity" means "behave as intended". ~Wiki I'm learning more about how the TPM performs integrity covering ...
6
votes
1answer
97 views

How does ROCA affect Windows secure boot?

I've been doing some research on the Infineon vulnerability known as ROCA over the last few days. As I understand it, the vulnerability is present when a TPM running vulnerable firmware generates an ...
0
votes
0answers
12 views

Secure boot to the OS flash drives/CD for bootloader signature verification and TPM/UFEI signing

I have been learning about securing the OS and don't understand how to do so, how secure it is and if it can verify the integrity of a system that could have possibly been compromised (ruling out the ...
1
vote
0answers
62 views

Verifying that the CRTM is read-only for the purpose of trusted computing

When using a TPM to provide integrity measurements for a system via SRTM, the trusted computing base is reduced to only the TPM and CRTM. The CRTM is a component of the BIOS (specifically the ...
2
votes
1answer
69 views

Distinguishing features of TPM from software solutions

It's said that TPM is proposed to address issues that software alone cannot. To my understanding, this means TPM cannot be simulated using software. For example, as far as I know, TPM comes with a ...
3
votes
2answers
323 views

What are BitLocker requirements against computer theft?

I'm using Windows 10 Pro edition and took the following actions: I've set up Bitlocker on both disks using the TPM (2.0) to boot the computer. I've also set a Windows password and I have no guest ...
1
vote
1answer
126 views

Hypothetical: if I wanted to swap my corp laptop for an exact replacement? [closed]

This is a thought problem. Not sure if appropriate for Info Sec or if better suited elsewhere, so I will respect the mod's decisions as far as remediation or removal. I love my corporate laptop. It's ...
6
votes
4answers
1k views

Usage of Android Keystore

I'm using the Android Keystore to store an asymmetric cryptographic (to decrypt a file containing an asymmetric key). I did that because I want to encrypt a large set of data and an asymmetric isn't ...
0
votes
0answers
80 views

How to sign bootloader?

I am looking for a way to sign my Ubuntu bootloader. I also have a TPM2 chip and an ability to do secureboot. Any suggestions?
5
votes
2answers
209 views

securing Ubuntu bootloader using TPM

I am currently working with Ubuntu 16.04 , with an Intel CPU that supports TPM2 module. I am trying to harden my boot-loader, i tried using trustedgrub2 fork that supports TPM2 , i understand that ...
0
votes
1answer
475 views

How are Bitlocker FDE keys stored in the TPM?

If you are using Windows 10 Pro Bitlocker FDE with a TPM and enhanced PIN (= passphrase): How do the keys in the TPM get stored? Are they stored as plaintext or hashvalue or 'again' encrypted?
3
votes
3answers
148 views

Can TPM be used in the same way as TrustZone area?

Can I program the TPM chip to execute a piece of code securely just like executing code in the TrustZone area? In particular, the application will be running in the normal world, but parts of it ...
1
vote
0answers
61 views

Extracting public key created by an UWP app in KeyCredentialManager

I know of an app that is using https://docs.microsoft.com/en-us/uwp/api/windows.security.credentials.keycredentialmanager to generate a key pair (supposedly stored in a TPM), and sequentially uses the ...
2
votes
1answer
588 views

How secure is bitlocker with a pin when whole machine is stolen?

I assume if I use Bitlocker on Windows 10 on a laptop with a TPM chip without a password, then if the laptop gets stolen, then the attacker can simply turn the machine on and then he gets to the ...
2
votes
1answer
262 views

Does a bitlocker pin become part of the key?

I recently added a pin to my bitlocker encryption and this seemed to be pretty much instant. In what way is this pin an actual part of the key that is needed to decrypt the hard drive? Or is it used ...
2
votes
0answers
234 views

Storing Wireless auth certs in a TPM

Within my organisation we're being asked to provide a secure but seamless wireless experience e.g. user logs on to Windows device and are connected automatically to corporate network via wireless. ...
9
votes
1answer
1k views

What are the functional similarities and difference between TPM and SGX in trusted computing?

I know about the TPM (Trusted Platform Module). In recent years, more researchers start to develop on Intel SGX, which I do not have any experience with. They are both crypto chips, but what are ...
1
vote
1answer
123 views

Is there a risk from anyone having access to a TPM chip before you install it?

I intend to add a TPM chip to my computer’s motherboard to enable Bitlocker encryption for Windows 10. I purchased the chip online, and I’m curious if there would theoretically be any security risk ...
3
votes
1answer
613 views

Using the TPM module to measure boot process and remote attestation

I have a question about Remote Attestation and measured boot with a TPM-Module. The illustration shows my project schematically. A TPM module will be used to measure the boot process and validate ...