Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [tpm]

A Trusted Platform Module (TPM) is a secure coprocessor found in some x86-based computers that provides cryptographic operations and system integrity measurements.

1
vote
1answer
36 views

How to protect devices that are reliant on Bitlocker and a password without TPM?

In working with a number of non-profit organizations, devices such as laptops used by staff are encrypted using Bitlocker. Unfortunately since the devices (often donated) do not feature TPM, Bitlocker ...
1
vote
1answer
22 views

Validate individual hardware components process

UFEI Secure Boot does not validate individual hardware components (SSD/hard drive, networking chips/card, video card, etc.) that can get infected. Is there anything currently available that's able to ...
0
votes
0answers
12 views

UFEI Secure Boot and TPM [duplicate]

UFEI uses TPM to form a root of trust but what software and hardware is included in UFEI Secure Boot chain of trust? Is the network card, motherboard and other parts that malware can infect included? ...
0
votes
0answers
40 views

Does using a 256 bit BitLocker key give you closer integration with hardware?

Reading TrueCrypt vs BitLocker I found the following line in the answer of user71148: Switch to 256-bit BEFORE encrypting your hard drive. Once you do that, BitLocker is safer for boot partition ...
2
votes
0answers
26 views

Use TPM2.0 to securely decrypt the hard drive in Linux — unattended

I already spent several days trying to figure out how to securely decrypt a hard drive on remote location using TPM2.0 in Linux. I'm no security expert and this is my first battle with TPM2.0. I ...
1
vote
0answers
23 views

With TPM how are the initial PCR values seeded with 'good' values?

I am trying to learn more about trusted boot / trusted platform modules and I understand about platform configuration values being a measurement of a 'good' configuration signed by a key locked from ...
2
votes
1answer
91 views

Is a TPM which boots a full-disk-encrypted computer to login secure?

Currently the laptops in use are encrypted using Pre-Boot-Authentication, so the entire disk is encrypted. A user has to enter a password before booting the operating system. A new concept suggests ...
2
votes
1answer
109 views

For a “normal” computer user, does it make a difference to have a good entropy source?

Let's take, for example, Linux. From my understanding, there are different sources and different ways that can be used to gather entropy (RNG daemon, Intel rrandr, TPM, etc). Some produce entropy that ...
0
votes
0answers
74 views

How common are computers with a TPM

When writing software, is it worth targeting a TPM for increased security? That boils down to: how common are normal business desktop and laptop computers with a TPM (not servers, not so interested ...
2
votes
0answers
45 views

TPM - Device Softwareupdate - What happens to my sealed key?

Imagine having a device that has a TPM (Trusted Platform Module). This TPM is used to store keys. Some of these keys are sealed to PCR constraints, meaning that they can only be opened if the PCRs ...
6
votes
3answers
288 views

How does Bitlocker + TPM prevent me seeing the HDD contents with another OS?

I've googled the heck out of this, and have read multiple related questions on this site, but I'm still missing a crucial piece of the puzzle. I have a (work) laptop with Win10 Pro which is encrypted ...
0
votes
0answers
50 views

Can Yubikey complement a TPM chip?

Does the functionality of an external hardware key overlaps 100% with the one provided by an embedded security chip on a laptop? Or can they complement each other? Although I assume an external key ...
1
vote
1answer
146 views

What is the safest way to use Bitlocker with TPM?

I started using bitlocker yesterday and I have a TPM2.0 in my laptop. I enabled the option to enter a pin when starting and I enabled the option to use AES256 before encrypting. I don't really ...
2
votes
0answers
174 views

Use TPM 1.2 to store the private key of a certificate

Let's say I have an application that requires certificates (HTTPS, MQTTs, etc.) due to the use of TLS. I'm planning to build my own tier-1 PKI hierarchy with my own company CA signing device ...
3
votes
1answer
147 views

How does full memory encryption in newer processes protect against DMA attacks?

Upcoming Intel CPUs have TME, current AMD processors have SME. These are full-memory encryption techniques to protect against physical attacks such as cold boot attacks. Both support encrypting the ...
1
vote
0answers
52 views

Are Authentication and Attestation two different process?

I'm a little bit unclear reading this from an article A TPM can also be used to store platform measurements that help ensure that the platform remains trustworthy. Authentication (ensuring ...
1
vote
1answer
67 views

How can a Trusted Platform Module “enhance network security”?

I've recently bought a motherboard, which has support for a Trusted Platform Module. On the topic, the manual states the following: This connector supports Trusted Platform Module (TPM) system, ...
5
votes
2answers
374 views

Does a TPM's benefits outweigh the risks?

Is TPM really worth it? According to Wikipedia it: Provides a generator of random numbers (that's okay) Facilities for the secure generation of cryptographic keys for limited uses (that's okay too I ...
1
vote
0answers
32 views

TPM and trust in cloud provider [closed]

I'm kinda unclear and confused ,i'm searching on the subject of trusted module platform and i can resume the main tpm's functions are: authentication functions, integrity measurement functions and ...
0
votes
0answers
64 views

TPM and the secret key

It's written that the TPM never allows these private keys to be exported outside the chip. This means that the only way to sign something with one of those keys is to use the computer to send a ...
1
vote
1answer
59 views

TPM with the three main groups of functions

I’m a little unclear on this (marked strong): "The public key authentication functions provide for on-chip key pair generation using a hardware random number generator, along with public key ...
5
votes
1answer
163 views

What use does a TPM have for accurate timekeeping?

I stumbled across this image and something immediately stood out to me. This is a photograph of a discrete TPM card. That silver cylinder on the left is a crystal oscillator, used to tell time with ...
0
votes
1answer
91 views

How does the TPM provide security for the cloud?

The primary scope of TPM is to assure the integrity of a platform. In this context, "integrity" means "behave as intended". ~Wiki I'm learning more about how the TPM performs integrity covering ...
6
votes
1answer
93 views

How does ROCA affect Windows secure boot?

I've been doing some research on the Infineon vulnerability known as ROCA over the last few days. As I understand it, the vulnerability is present when a TPM running vulnerable firmware generates an ...
0
votes
0answers
12 views

Secure boot to the OS flash drives/CD for bootloader signature verification and TPM/UFEI signing

I have been learning about securing the OS and don't understand how to do so, how secure it is and if it can verify the integrity of a system that could have possibly been compromised (ruling out the ...
1
vote
0answers
47 views

Verifying that the CRTM is read-only for the purpose of trusted computing

When using a TPM to provide integrity measurements for a system via SRTM, the trusted computing base is reduced to only the TPM and CRTM. The CRTM is a component of the BIOS which executes first and ...
2
votes
1answer
66 views

Distinguishing features of TPM from software solutions

It's said that TPM is proposed to address issues that software alone cannot. To my understanding, this means TPM cannot be simulated using software. For example, as far as I know, TPM comes with a ...
3
votes
2answers
251 views

What are BitLocker requirements against computer theft?

I'm using Windows 10 Pro edition and took the following actions: I've set up Bitlocker on both disks using the TPM (2.0) to boot the computer. I've also set a Windows password and I have no guest ...
1
vote
1answer
126 views

Hypothetical: if I wanted to swap my corp laptop for an exact replacement? [closed]

This is a thought problem. Not sure if appropriate for Info Sec or if better suited elsewhere, so I will respect the mod's decisions as far as remediation or removal. I love my corporate laptop. It's ...
5
votes
4answers
917 views

Usage of Android Keystore

I'm using the Android Keystore to store an asymmetric cryptographic (to decrypt a file containing an asymmetric key). I did that because I want to encrypt a large set of data and an asymmetric isn't ...
0
votes
0answers
70 views

How to sign bootloader?

I am looking for a way to sign my Ubuntu bootloader. I also have a TPM2 chip and an ability to do secureboot. Any suggestions?
3
votes
0answers
122 views

securing Ubuntu bootloader using TPM

I am currently working with Ubuntu 16.04 , with an Intel CPU that supports TPM2 module. I am trying to harden my boot-loader, i tried using trustedgrub2 fork that supports TPM2 , i understand that ...
0
votes
1answer
393 views

How are Bitlocker FDE keys stored in the TPM?

If you are using Windows 10 Pro Bitlocker FDE with a TPM and enhanced PIN (= passphrase): How do the keys in the TPM get stored? Are they stored as plaintext or hashvalue or 'again' encrypted?
3
votes
3answers
142 views

Can TPM be used in the same way as TrustZone area?

Can I program the TPM chip to execute a piece of code securely just like executing code in the TrustZone area? In particular, the application will be running in the normal world, but parts of it ...
1
vote
0answers
46 views

Extracting public key created by an UWP app in KeyCredentialManager

I know of an app that is using https://docs.microsoft.com/en-us/uwp/api/windows.security.credentials.keycredentialmanager to generate a key pair (supposedly stored in a TPM), and sequentially uses the ...
1
vote
1answer
488 views

How secure is bitlocker with a pin when whole machine is stolen?

I assume if I use Bitlocker on Windows 10 on a laptop with a TPM chip without a password, then if the laptop gets stolen, then the attacker can simply turn the machine on and then he gets to the ...
2
votes
1answer
222 views

Does a bitlocker pin become part of the key?

I recently added a pin to my bitlocker encryption and this seemed to be pretty much instant. In what way is this pin an actual part of the key that is needed to decrypt the hard drive? Or is it used ...
2
votes
0answers
200 views

Storing Wireless auth certs in a TPM

Within my organisation we're being asked to provide a secure but seamless wireless experience e.g. user logs on to Windows device and are connected automatically to corporate network via wireless. ...
8
votes
1answer
998 views

What are the functional similarity and difference between TPM and SGX in trust computing?

I have the knowledge of TPM (Trusted Platform Module). In recent years, more researchers start to develop on Intel SGX, which I do not have any experience. They are both crypto chips, but what are ...
1
vote
1answer
114 views

Is there a risk from anyone having access to a TPM chip before you install it?

I intend to add a TPM chip to my computer’s motherboard to enable Bitlocker encryption for Windows 10. I purchased the chip online, and I’m curious if there would theoretically be any security risk ...
3
votes
1answer
540 views

Using the TPM module to measure boot process and remote attestation

I have a question about Remote Attestation and measured boot with a TPM-Module. The illustration shows my project schematically. A TPM module will be used to measure the boot process and validate ...
1
vote
0answers
112 views

ROCA attack on TPM - public key extraction

I was reading about the ROCA attack, and how a lot of software is vulnerable. Apparently Bitlocker from Microsoft is also vulnerable, because it protects its keys with SRK of (ROCA vulnerable) TPM. ...
4
votes
0answers
133 views

Security of TPM 1.2 for providing tamper-evidence against firmware modification

I would like to use a TPM for providing tamper-evidence to my workstation, using SRTM (Static Root-of-Trust for Measurement). Currently, I plan to have the TPM seal a one-time value which only I know, ...
40
votes
7answers
21k views

Can we tamper-proof a game that's sold along with the Windows machine it runs on?

We want to protect a game that is basically sold with the computer containing it. The security is done this way: The HDD is encrypted using hardware TPM 1.2, which holds a unique key to decrypt the ...
0
votes
1answer
88 views

How can I detect a MITM when the communication partner is in on it?

I was thinking about a host computer having a hardware TPM (Trusted Platform Module), with which I can get trustworthy information about the platform (first and foremost, that I am not in a virtual ...
2
votes
1answer
254 views

Is a TPM module insecure if not soldered to the board?

I am looking into Bitlocker for my headless Microserver N54l with windows server 2016 on it. I saw that the n54l has no TPM module, but I can buy one and plug it to the board. I am interested in it ...
0
votes
2answers
777 views

Hardware / firmware backdoors : TPM as a security risk - How to turn it into security advantage?

--- Question: What are the exact risks of using TPM 2.0 or owning this integrated chip? In what circumstances? What are the solutions to minimize risks? Details: My primary goal was to try to find ...
3
votes
1answer
717 views

Is it possible to extract secrets from a TPM without knowing the PIN?

I understand the general operation of a TPM, and in particular the interest of using a pre-boot PIN: if someone gets access to the machine (turned off), turning on the computer will not be enough to ...
0
votes
1answer
446 views

How Does The TPM Work With The CPU To Decrypt Data

Okay, from what I've been reading, At startup, the BIOS performs an integrity check and produces a hash value to set in the PCRs of the TPM (aka Core Root of Trust Module), and when all of the needed ...
2
votes
1answer
243 views

Preventing new NVRAM areas from being defined in a TPM

Is there anyway to prevent new NVRAM areas from being defined on a TPM until the next reboot (similar to power-cycle types of protection)? The reason I ask is because firmware could check for NVRAM ...