Questions tagged [tpm]

A Trusted Platform Module (TPM) is a secure coprocessor found in some x86-based computers that provides cryptographic operations and system integrity measurements.

0
votes
0answers
31 views

What are the security protections in using a TPM generated VSC to create a CSR

I am extremely new to the field of information security but was given a project to create a secure TLS certificate signed by our CA for a new security process. I found this thread (How to generate a ...
0
votes
0answers
80 views

TLS 1.3 protected by TPM 2.0

I have seen some implementation of TLS using TPM 2.0 like the tpm2-tss-engine engine which can be used to protect the server private key associated with the certificate and sign with it inside the ...
2
votes
0answers
61 views

Perform quote operation over NV-memory in TPM

It is known that is possible to define an NV Extend Index which has a behaviour similar to a PCR (Platform Configuration Register) and it is possible to modify it using TPM2_NV_Extend() operation. ...
0
votes
0answers
58 views

TPM 2.0 Bus Encryption / Decryption?

It seems that in TPM 2.0 a call to TPM2_StartAuthSession() is able to start a decrypt/encrypt session. However, the caller forwards all the key generation material to the TPM in plaintext, and then ...
1
vote
1answer
67 views

Bitlocker, does additional authentication at startup with TPM device provide any extra security?

Will enabling additional authentication on startup provide any extra security with Bitlocker? At the moment, my laptop boots straight into a Windows login where I use a pin. If I chose to not use pin, ...
0
votes
2answers
159 views

TPM 1.2 or Intel PTT

While configuring a Lenovo Thinkpad T450s I stumbled across the option choosing how one would like to implement TPM. It gives the options: Hardware TPM chip with TPM 1.2 mode Intel PPT with TPM 2.0 ...
1
vote
2answers
166 views

Device security in IOT

I am working on an IOT device that sends data to the server after authenticating itself to the server. Is there a way to safely store my device's credentials for logging onto the main server and ...
0
votes
0answers
36 views

Is it possible to use wolfTPM SDK to talk to a TPM 2.0 chip from within a docker container?

Is it possible to use wolfTPM SDK to talk to a TPM 2.0 chip from within a Docker container?
0
votes
0answers
25 views

Is it possible to use the SunPKCS11 provider to talk to a TPM2.0 chip using TPM2-PK11 library?

I have a TPM 2.0 chip which contains an RSA signing key (AIK) and I would like to sign a message using Java and I was wondering whether it would be possible to use the SunPKCS11 provider to interface ...
0
votes
1answer
114 views

Device authentication, common method

My question is: What are some standard device authentication methods, in a scenario when: The desktop computer is being authenticated on web service I provide the .exe on the desktop I control the ...
0
votes
0answers
42 views

What is the difference between SGX and TPM? [duplicate]

What is the difference between Intel Guard Extensions (SGX) and Trusted Module Platform (TPM)? This answer tells you what the similarities are and what the features are, but not explicitly what the ...
0
votes
0answers
40 views

Enclosed FDE, Bridge & chipset FDE. what is the difference to SED

I was reading hardware based encryption, and found out that they are basically of 3 types. 1) SED - Encryption/Decryption done by the drive circuitry. Unlocked via Pre boot authentication. Can use ...
0
votes
0answers
10 views

Any limitaion of clnt_call() in RPC communication?

I have a RPC server and RPC client. Am generating a secure key on client side using TPM1.2 chip. When i run my program for few times everything works fine. But When i run for many times then key is ...
2
votes
1answer
80 views

Where to store signing key in TPM

I'm using TPM 2.0 to do a remote attestation for a computer. In order to do that you have to generate a signing key from a primary key. This generate a public key and an encrypted private key. As per ...
2
votes
0answers
85 views

Purpose of TPM “ownership” and “owner password”

I have a laptop with TPM 2.0, dual-booting Windows 10 and Linux. By default, Windows automatically takes ownership of the TPM with a throwaway password, but can be configured to store it in the ...
0
votes
1answer
99 views

Asymmetric/Symmetric Encryption of a TPM key hierarchy

I know that keys in a TPM key hierarchy are encrypted with their parent keys. But I read that those parent keys (for instance an asymmetric SRK) need to have some symmetric secret for said encryption. ...
1
vote
0answers
74 views

Key Hierarchies in TPM 2.0

I am currently trying to figure out just how key hierarchies in a TPM 2.0 work. I read that there are four possible hierarchies (storage, endorsement, platform, null). I also read, that these ...
1
vote
0answers
57 views

using sha256 to check for boot tampering

Consider the following machine: Dual Boots to two OSes, OS "A" and OS "B" OS "A" is trusted The bios is trusted. The root partition of OS "A" is encrypted OS "A" doesn't support secure boot OS "B" is ...
2
votes
1answer
71 views

Can a TPM chip check if the bios is still in it's factory setting?

Can TPM (trusted platform module) be used to verify if a used laptop's bios, the bootloader and related components have not been tampered with in the past, i. e. whether those components are still in ...
5
votes
0answers
261 views

What's the difference between Secure Boot and Attestation?

What's the exact difference between secure boot and device attestation. Nowadays with secure devices both are used, even at the same time, when in the core they do similar things, which is ...
1
vote
1answer
262 views

FIDO2 on Windows: Why do I need a TPM?

I just installed the Windows 10 1809 update, which includes support for FIDO2 passwordless sign-in. I own a Yubikey 5, which supports this standard. However, I am not able to set up Windows Hello, a ...
2
votes
1answer
89 views

Can I prove the relation between AIK and EK without asking to the TPM 2.0?

The Endorsement Key (EK), the Public part, is available directly on the TPM chip, I know that you can generate an AIK key and then sign with that key, the hash must be generated by the TPM. The idea ...
1
vote
1answer
100 views

TPM and remote attestation

I am currently trying to figure out just how remote attestation for a TPM works in combination with the PCR-values. Is it true that the PCR values are only measured on system boot and cannot be ...
1
vote
1answer
137 views

How to protect devices that are reliant on Bitlocker and a password without TPM?

In working with a number of non-profit organizations, devices such as laptops used by staff are encrypted using Bitlocker. Unfortunately since the devices (often donated) do not feature TPM, Bitlocker ...
1
vote
1answer
54 views

Validate individual hardware components process

UFEI Secure Boot does not validate individual hardware components (SSD/hard drive, networking chips/card, video card, etc.) that can get infected. Is there anything currently available that's able to ...
5
votes
1answer
896 views

Use TPM2.0 to securely decrypt the hard drive in Linux — unattended

I already spent several days trying to figure out how to securely decrypt a hard drive on remote location using TPM2.0 in Linux. I'm no security expert and this is my first battle with TPM2.0. I ...
1
vote
0answers
152 views

With TPM how are the initial PCR values seeded with 'good' values?

I am trying to learn more about trusted boot / trusted platform modules and I understand about platform configuration values being a measurement of a 'good' configuration signed by a key locked from ...
2
votes
1answer
188 views

Is a TPM which boots a full-disk-encrypted computer to login secure?

Currently the laptops in use are encrypted using Pre-Boot-Authentication, so the entire disk is encrypted. A user has to enter a password before booting the operating system. A new concept suggests ...
2
votes
1answer
121 views

For a “normal” computer user, does it make a difference to have a good entropy source?

Let's take, for example, Linux. From my understanding, there are different sources and different ways that can be used to gather entropy (RNG daemon, Intel rrandr, TPM, etc). Some produce entropy that ...
0
votes
0answers
89 views

How common are computers with a TPM

When writing software, is it worth targeting a TPM for increased security? That boils down to: how common are normal business desktop and laptop computers with a TPM (not servers, not so interested ...
3
votes
0answers
93 views

TPM - Device Softwareupdate - What happens to my sealed key?

Imagine having a device that has a TPM (Trusted Platform Module). This TPM is used to store keys. Some of these keys are sealed to PCR constraints, meaning that they can only be opened if the PCRs ...
7
votes
3answers
2k views

How does Bitlocker + TPM prevent me seeing the HDD contents with another OS?

I've googled the heck out of this, and have read multiple related questions on this site, but I'm still missing a crucial piece of the puzzle. I have a (work) laptop with Win10 Pro which is encrypted ...
0
votes
0answers
425 views

Can Yubikey complement a TPM chip?

Does the functionality of an external hardware key overlaps 100% with the one provided by an embedded security chip on a laptop? Or can they complement each other? Although I assume an external key ...
2
votes
1answer
730 views

What is the safest way to use Bitlocker with TPM?

I started using bitlocker yesterday and I have a TPM2.0 in my laptop. I enabled the option to enter a pin when starting and I enabled the option to use AES256 before encrypting. I don't really ...
2
votes
0answers
477 views

Use TPM 1.2 to store the private key of a certificate

Let's say I have an application that requires certificates (HTTPS, MQTTs, etc.) due to the use of TLS. I'm planning to build my own tier-1 PKI hierarchy with my own company CA signing device ...
5
votes
1answer
649 views

How does full memory encryption in newer processes protect against DMA attacks?

Upcoming Intel CPUs have TME, current AMD processors have SME. These are full-memory encryption techniques to protect against physical attacks such as cold boot attacks. Both support encrypting the ...
1
vote
0answers
194 views

Are Authentication and Attestation two different process?

I'm a little bit unclear reading this from an article A TPM can also be used to store platform measurements that help ensure that the platform remains trustworthy. Authentication (ensuring ...
1
vote
1answer
172 views

How can a Trusted Platform Module “enhance network security”?

I've recently bought a motherboard, which has support for a Trusted Platform Module. On the topic, the manual states the following: This connector supports Trusted Platform Module (TPM) system, ...
7
votes
2answers
986 views

Does a TPM's benefits outweigh the risks?

Is TPM really worth it? According to Wikipedia it: Provides a generator of random numbers (that's okay) Facilities for the secure generation of cryptographic keys for limited uses (that's okay too I ...
1
vote
0answers
42 views

TPM and trust in cloud provider [closed]

I'm kinda unclear and confused ,i'm searching on the subject of trusted module platform and i can resume the main tpm's functions are: authentication functions, integrity measurement functions and ...
0
votes
0answers
93 views

TPM and the secret key

It's written that the TPM never allows these private keys to be exported outside the chip. This means that the only way to sign something with one of those keys is to use the computer to send a ...
1
vote
1answer
171 views

TPM with the three main groups of functions

I’m a little unclear on this (marked strong): "The public key authentication functions provide for on-chip key pair generation using a hardware random number generator, along with public key ...
5
votes
1answer
254 views

What use does a TPM have for accurate timekeeping?

I stumbled across this image and something immediately stood out to me. This is a photograph of a discrete TPM card. That silver cylinder on the left is a crystal oscillator, used to tell time with ...
0
votes
1answer
185 views

How does the TPM provide security for the cloud?

The primary scope of TPM is to assure the integrity of a platform. In this context, "integrity" means "behave as intended". ~Wiki I'm learning more about how the TPM performs integrity covering ...
6
votes
1answer
100 views

How does ROCA affect Windows secure boot?

I've been doing some research on the Infineon vulnerability known as ROCA over the last few days. As I understand it, the vulnerability is present when a TPM running vulnerable firmware generates an ...
1
vote
1answer
117 views

Verifying that the CRTM is read-only for the purpose of trusted computing

When using a TPM to provide integrity measurements for a system via SRTM, the trusted computing base is reduced to only the TPM and CRTM. The CRTM is a component of the BIOS (specifically the ...
2
votes
1answer
83 views

Distinguishing features of TPM from software solutions

It's said that TPM is proposed to address issues that software alone cannot. To my understanding, this means TPM cannot be simulated using software. For example, as far as I know, TPM comes with a ...
3
votes
2answers
451 views

What are BitLocker requirements against computer theft?

I'm using Windows 10 Pro edition and took the following actions: I've set up Bitlocker on both disks using the TPM (2.0) to boot the computer. I've also set a Windows password and I have no guest ...
1
vote
1answer
130 views

Hypothetical: if I wanted to swap my corp laptop for an exact replacement? [closed]

This is a thought problem. Not sure if appropriate for Info Sec or if better suited elsewhere, so I will respect the mod's decisions as far as remediation or removal. I love my corporate laptop. It's ...
6
votes
4answers
3k views

Usage of Android Keystore

I'm using the Android Keystore to store an asymmetric cryptographic (to decrypt a file containing an asymmetric key). I did that because I want to encrypt a large set of data and an asymmetric isn't ...