Skip to main content
OverflowAI is here! AI power for your Stack Overflow for Teams knowledge community. Learn more

Questions tagged [tpm]

A Trusted Platform Module (TPM) is a secure coprocessor found in some x86-based computers that provides cryptographic operations and system integrity measurements.

Filter by
Sorted by
Tagged with
1 vote
0 answers
65 views

How and why can a TPM be used for disk encryption or DRM?

I don't know much about TPMs, and I admittedly don't know as much about cryptography as I'd like to, though I am quite familiar with basic concepts. For the past two hours I've been attempting to ...
Nullcaller's user avatar
0 votes
0 answers
38 views

How to securely store signature file

I am using TPM to to encrypt and sign my data. But since I am not security expert, I need to come to you guys :D I am developing this app to verify file content. I already has this part sorted out ...
Croksie's user avatar
0 votes
1 answer
79 views

How and who calculate the PCR values?

Who is responsible for calculating the Platform Configuration Register (PCR) value? Is the operation system or the TPM? What if the operating system is hacked? Can the hacked system always calculate ...
JACK GAO's user avatar
1 vote
1 answer
151 views

PCR 7 in TPM 2.0 has always the same value

First of all, I must say that I'm using a VM with an emulated TPM 2.0. I've created an LUKS2 encrypted partition and configured the TPM 2.0 to unseal the key only if the PCR 7 has a certain value. For ...
Blasco's user avatar
  • 11
0 votes
1 answer
122 views

TPM - How the integrity of the system configuration is guaranteed if the PCR hash is overwritten on each "Measurement"?

In the TPM architecture, we know that after a "Measurement" procedure is performed, it is followed by a "PCR Extend" procedure, in which the resulting system configuration metrics ...
programings's user avatar
4 votes
1 answer
213 views

How does measured boot work using TPM

Within the measured boot process, consider a scenario where I aim to create a measurement for a specific piece of code, perhaps, for illustrative purposes, a potentially malicious operating system. so ...
ezio's user avatar
  • 141
1 vote
3 answers
239 views

How to bind TPM2.0 AK to the "AK name" used in tpm2_makecredential, and how is trust established in AIK?

During remote attestation, a device sends the server the EK certificate, AK public, AK name. By using tpm2_makecredential/tpm2_activatecredential, the attestation sever can confirm that: the EK is ...
SKK's user avatar
  • 11
0 votes
0 answers
132 views

How to prevent public key tampering

I have to store a document (e.g. a JSON file) on a remote PC (that my App is running on) alongside a signature to be able to verify that this file was signed by me. I have no access to this PC nor ...
Croksie's user avatar
2 votes
0 answers
121 views

Did Android remove Fingerprint/Passcode for WebAuthN and lower security to push Passkeys?

So, before this year, when you were using WebAuthN to create security keys on an up to date Android phone (Pixel 6 in my case), you had these options (iirc): When creating a platform authenticator, ...
xsrf's user avatar
  • 178
1 vote
1 answer
171 views

Why the TPM PCRs does not consider a UEFI settings change? If someone resets CMOS, it's undetected

In my laptop I've set up a bios password when I power on the laptop, and once I enter it the laptop starts my linux distro and decrypts the disk without asking any other password. To do this I've set ...
Allexj's user avatar
  • 137
1 vote
0 answers
118 views

What are the Symmetric Algorithm, Scheme, and KDF parameters used for in TPM2 CreatePrimary?

When interfacing with a TPM 2.0 device, you can request that it calculate the TPM's Endorsement Keys as "Primary" Objects using CreatePrimary. As I understand it, the TPM's singular ...
Huckle's user avatar
  • 111
1 vote
1 answer
216 views

Using TPM to unlock LUKS/dm-crypt volume

I am trying to understand the risks of configuring passwordless decryption via TPM of a LUKS/dm-crypt system with something like: systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+1+2+3+4+5+7+8 /...
StrongBad's user avatar
  • 261
2 votes
1 answer
220 views

Can I set up a TPM2 policy that ANDs multiple OR policies?

I'd like to define a TPM access policy that allowlists multiple different values for certain PCRs. Hence, i'd like a policy like this: (PolicyOR(PolicyPCR(value1,pcr4),PolicyPCR(value2,pcr4),PolicyPCR(...
user175104's user avatar
0 votes
0 answers
124 views

PCR to prevent TPM2 key unsealing in case of rogue DMA devices connected?

Security threat: physical theft of a laptop and a server that use TPM2 auto unlock FDE with LUKS. In both cases the TPM checks against some PCRs before unsealing the key. The laptop prompts for a TPM ...
Polizi8's user avatar
  • 163
1 vote
0 answers
345 views

Using a TPM for host authentication during PXE boot

I have a stateless machine that is PXE booting from some host, and I'm curious if there is some clever way to achieve host authentication by only using the TMP (No UEFI Secure Boot). For obvious ...
David Davidson's user avatar
2 votes
0 answers
339 views

How to wrap/unwrap with TPM2 endorsement key

I have a remote client A which wants to communicate securely with a server B having a discrete TPM. My understanding is that each TPM normally come with a endorsement key from manufacture like ...
feplooptest's user avatar
0 votes
0 answers
79 views

Is TPM NV deletion protection possible?

I want to implement a counter that cannot be tampered with using TPM. It seems that it is possible to force data not to be written by enabling only nv-increment. However, if nv is deleted with nv-...
user212942's user avatar
0 votes
0 answers
506 views

Bitlocker TPM + PIN vs password without TPM [duplicate]

I keep reading how it's best to use Bitlocker's full disk encryption with a TPM + PIN instead of just a passphrase twithout a TPM but I've been wondering why. Assuming that a very strong password is ...
Brickwall's user avatar
1 vote
1 answer
856 views

How does a TPM module protect keys LUKS keys on Linux

I'm looking into hardening an embedded device using TPM2 with an encrypted root (/) Linux partition. I've found various articles explaining how to embed LUKS keys into the TPM (eg this one). Unless ...
Philip Couling's user avatar
0 votes
0 answers
192 views

Advice on encryption setup

I've been trying to get a reliable, and decently secure setup on a device for a little while now, and I feel like I may be overthinking some things but I am unsure. Just to clear things up, this is ...
Kalcifer's user avatar
  • 173
2 votes
1 answer
256 views

What are the security differences between TPM1.2, TPM2.0, Intel PTT, and AMD fTPM?

As far as I am aware, to the OS, PTT, and fTPM are indistinguishable from TPM2.0. What I am curious about, are the physical security differences between the different TPM providers. A dedicated TPM2 ...
Kalcifer's user avatar
  • 173
1 vote
0 answers
73 views

When can TPM_Start(ST_Clear) be issued to a TPM?

TPM 1.2 has an NVRAM permission attribute called TPM_NV_PER_WRITE_STCLEAR. The TPM 1.2 specification describes it as The value is writable until a write to the specified index with a datasize of 0 is ...
Melab's user avatar
  • 247
1 vote
1 answer
153 views

How does a TPM verify the identity of the calling process/service?

Any application can use a TPM chip to securely create and store cryptographic keys. For example for Digital Rights Management (DRM) or for prevention of cheating in online games. However, how can a ...
Equinox's user avatar
  • 21
0 votes
1 answer
219 views

Does faulTPM defeat the LUKS-based FDE with a passphrase?

The recent faulTPM paper (https://arxiv.org/pdf/2304.14717v1.pdf) deals mostly with Bitlocker and only mentions LUKS to note the differences. The authors state: With a passphrase, however, the same ...
Leprechaun's user avatar
3 votes
1 answer
1k views

How can an application, using Apple's Secure Enclave on macOS or TPM on Windows, protect itself from other applications accessing its private keys?

I'm interested in using Apple's Secure Enclave on macOS or TPM on Windows to protect cryptographic keys used by an application from being accessed by other applications running with the same or higher ...
Pathong's user avatar
  • 56
3 votes
2 answers
673 views

TPM - ECC based encryption / decryption using the public key

Our device comes with a device certificate which was signed with our private registration authority (CA). The private key (type ECC) was generated on the device itself - to be more specific directly ...
TrinityTonic's user avatar
0 votes
1 answer
826 views

Can TPM be used for SSL Client Certificates for an existing applications?

Is it possible to use TPM for SSL Client Authentication (with a client certificate) and thereby ensure on the server/backend side knows, that the request comes from the specific client machine (even ...
Nathan's user avatar
  • 361
4 votes
1 answer
260 views

Laptop TPM with physical presence key operations?

It seems most systems have a TPM 2 module in them now, and it seems those modules often have a physical presence pin. Are these pins actually used by any typical laptop manufactures? I have a laptop ...
ARandomBob's user avatar
2 votes
1 answer
320 views

Are TPM PCRs volatile, non-volatile, or both?

Do PCRs (Platform Configuration Registers) on TPMs (Trusted Platform Modules) retain their data on reboot? I'm trying to find out if all (or some) of the PCRs on a TPM are volatile (will loose their ...
Michael Altfield's user avatar
0 votes
1 answer
308 views

Security and practicality of passing secrets to services running as non-privileged user

I strongly dislike and mistrust the practice to store secrets in plain text files for unattended access by services. This is increasingly less of an issue in modern deployments where secrets are ...
Michael's user avatar
  • 113
2 votes
1 answer
431 views

TPM PCRs not reset on TPM reset or on reboot

I have a Raspberry Pi with a TPM chip, where I use the TPM for disk encryption. The disk encryption password is sealed to the TPM using PCR register 0. I extend the PCR on the start of the system with ...
Jan Wytze's user avatar
  • 133
0 votes
1 answer
626 views

What threats can the use of a TPM by a password manager mitigate?

This question is about the use of a TPM by a password manager used by an end-user on a PC to store and use passwords to log in to web sites and other things that are protected only by a password. ...
alx9r's user avatar
  • 569
1 vote
0 answers
158 views

TPM FAPI sealing data inside /dev

I am using TPM simulator in my local VM to test FAPI API and am able to seal the important data inside directory ~/.local/share/tpm2-tss/user/keystore as per the path mentioned in config file /etc/...
chandu's user avatar
  • 161
1 vote
0 answers
130 views

Symmetric key importance During encrypt and decrypt [closed]

I am performing a small command line operation the goal is to generate a symmetric key using openssl and store the key in TPM FAPI keystore. After modifying the symmetric key, the decryption should ...
chandu's user avatar
  • 161
1 vote
0 answers
130 views

Is there any use case of DAA (Direct Anonymous Attestation) in TPM?

I want to know the use cases of DAA (Direct Anonymous Attestation) in the real world.
user97821's user avatar
2 votes
1 answer
870 views

Store/Secure openssl cert and key file in TPM2.0

I have my TPM2.0 connected to my raspberry pi. I generated a Cert file and Private key using openssl. These files are used to connect MQTT with TLS. How do I store/secure these files in/with the TPM ...
SudoObey's user avatar
1 vote
0 answers
182 views

The 3-level hierarchy of keys in TPM 2.0

I have a task to create the 3-level RSA key hierarchy (with wolfTPM library), where keys of the 2nd and the 3rd levels are imported keys. Here are the steps that I follow: Generate a primary key on ...
Victoria Seniuk's user avatar
0 votes
1 answer
478 views

Why does my TPM-chip report to support symmetric encryption algorithms, while not supporting symmetric encryption

I would like to use my TPM chip to symmetrically encrypt some data, but sadly the tpm2_getcap commands command states that symmetric encryption is not supported by my chip. The thing I find unusual is ...
Jan Wytze's user avatar
  • 133
0 votes
1 answer
268 views

How does a TPM decide if an application can get cryptographic services?

There is an answered question which asks about the specifics and the answers are technical. I am looking for a conceptual answer in a ELI5 manner. A TPM is a hardware chip which stores critical keys. ...
TheMeaningfulEngineer's user avatar
1 vote
2 answers
103 views

Autogenerated PINs

PINs secured by TPM or similar hardware are secure even if short and only numeric because the TPM can throttle and lock after several attempts. I'm concerned about PIN reuse. I suspect most people are ...
Bruno Martinez's user avatar
1 vote
1 answer
235 views

What is the reason why Microsoft decided not to provide updates when bypassing TPM requirements?

I understand TPM is quite an important tool for security, but a lot of the updates not being offered should not be related to TPM. Not offering updates to people who bypass TPM on Windows 11 and also ...
moo's user avatar
  • 87
1 vote
2 answers
376 views

What makes TPM "trusted"?

I was just going through TPM Overview and What makes TPM chip Endorsement Key Non-migratable? but it seems like the "trust" is a matter of "trusting" the manufacturer to not be ...
Archimedes Trajano's user avatar
0 votes
1 answer
798 views

fTPM more secure than TPM when using Bitlocker?

Is fTPM more secure than a real TPM module when using Bitlocker? As far as I know, you should enable pre-boot authentication if you use a TPM module that is plugged separately onto the motherboard to ...
Opa114's user avatar
  • 101
1 vote
1 answer
177 views

Is it possible to allow only a certain secure USB boot media to boot an UEFI system?

I want to restrict all USB boot media from my system, except for a certain USB boot drive that I declare secure via a certain key. Is this possible using UEFI/Secure Boot/TPM? Maybe via TPM? TPM gets ...
JohnnyFromBF's user avatar
  • 1,413
4 votes
1 answer
749 views

Use platform TPM as U2F for web applications

The Problem: Use the platform TMP of my Windows Laptop/PC (no external device or USB token) as U2F in a web application to check if it is a known device. My intended solution: I need to store/create ...
MrMaavin's user avatar
0 votes
1 answer
760 views

How to preserve key in TPM 2.0

I've been looking into TPM 2.0 with .NET (TSS.MST), and I don't understand how to preserve key upon application rerun. TSS.MST provides a binary simulating the TPM2.0 device and the app is connecting ...
Kostas Moisidis's user avatar
1 vote
1 answer
2k views

TPM use without secure boot

I've been asked to improve the security of my company's iot device, and encrypt a storage partition. It's a general purpose arm based device, and currently can boot from a variety of sources (USB, ...
Alex's user avatar
  • 111
0 votes
0 answers
246 views

Microsoft Pluton Security Chip - Specs and API?

Microsoft introduced a new security chip dubbed Pluton that is ought to become mandatory for systems running Windows (11 and forward). AMD has already implemented or is about to implement the chip as ...
ndbd's user avatar
  • 201
1 vote
2 answers
966 views

TPM Endorsement Key usage in secure and trusted boot

Taking into account a Root of Trust in a device using a TPM. My understanding is that the bootloader, firmware, operating system, applications etc. are all verified on startup by validating signatures ...
Engineer999's user avatar
3 votes
1 answer
719 views

Secure boot after an OTA update confusion

My understanding is that secure boot works by verifying each stage in the boot process before proceeding. So first, UEFI or booting firmware will validate the signature of the bootloader, then kernel, ...
Engineer999's user avatar

1
2 3 4 5 6