Questions tagged [tpm]

A Trusted Platform Module (TPM) is a secure coprocessor found in some x86-based computers that provides cryptographic operations and system integrity measurements.

Filter by
Sorted by
Tagged with
0 votes
0 answers
80 views

Chrome U2F Authentication TouchID vs YubiKey/Hardware token

If I have a YubiKey/other hardware key, then I can add that as a U2F device and restrict logins to require that hardware key to be present when logging in to web sites with my username and password. ...
user avatar
2 votes
0 answers
90 views

Use platform TPM as U2F for web applications

The Problem: Use the platform TMP of my Windows Laptop/PC (no external device or USB token) as U2F in a web application to check if it is a known device. My intended solution: I need to store/create ...
user avatar
0 votes
1 answer
54 views

How to preserve key in TPM 2.0

I've been looking into TPM 2.0 with .NET (TSS.MST), and I don't understand how to preserve key upon application rerun. TSS.MST provides a binary simulating the TPM2.0 device and the app is connecting ...
user avatar
0 votes
1 answer
91 views

TPM use without secure boot

I've been asked to improve the security of my company's iot device, and encrypt a storage partition. It's a general purpose arm based device, and currently can boot from a variety of sources (USB, ...
user avatar
  • 101
0 votes
0 answers
72 views

Microsoft Pluton Security Chip - Specs and API?

Microsoft introduced a new security chip dubbed Pluton that is ought to become mandatory for systems running Windows (11 and forward). AMD has already implemented or is about to implement the chip as ...
user avatar
  • 191
1 vote
2 answers
121 views

TPM Endorsement Key usage in secure and trusted boot

Taking into account a Root of Trust in a device using a TPM. My understanding is that the bootloader, firmware, operating system, applications etc. are all verified on startup by validating signatures ...
user avatar
3 votes
1 answer
360 views

Secure boot after an OTA update confusion

My understanding is that secure boot works by verifying each stage in the boot process before proceeding. So first, UEFI or booting firmware will validate the signature of the bootloader, then kernel, ...
user avatar
0 votes
4 answers
230 views

Can TPM2 disk encryption protect data after full server theft?

I read about TPM2 with PCR locking full-disk encryption from different sources. For example [1]. What I can't understand is how much does this protect from full server theft. If we assume that TPM2 ...
user avatar
0 votes
1 answer
337 views

VeraCrypt New Processor TPM Message Issue

I upgraded my processor and now I get this message when starting my computer: We detected a new processor which will change the data/structure of the storage space for firmware TPM. If you did not ...
user avatar
1 vote
1 answer
97 views

What is the point of an OS (Win11) requiring a TPM (or vTPM) beyond a layer of DRM?

Windows 11 requiring a TPM of some sort seems more like a DRM preventing me from duplicating a W11 Virtual Machine on multiple systems and distributing it versus any tangible benefit to the end-user. ...
user avatar
0 votes
0 answers
33 views

Prove Private Key came from Apple Secure Enclave

With TPM 2.0, it's possible to prove that the private key of an asymmetric key pair came from a TPM device (and thus is effectively inaccessible). Is this possible with Apple's Secure Enclave on macOS?...
user avatar
  • 101
0 votes
0 answers
207 views

TPM vs TCM - InTune and BitLcoker compliance in China

It appears that TPM is banned in China, therefore, Dell laptops shipped to China are equipped with TCM chips instead of TPM. How secure is TCM? gov backdoors? Wondering how does if devices with TCM ...
user avatar
2 votes
1 answer
294 views

Usage of TPM PCRs in Linux

Where can I find the list of what each PCR "represents" in the TPM for a Linux OS? The official guide I found (https://trustedcomputinggroup.org/wp-content/uploads/...
user avatar
  • 121
1 vote
1 answer
77 views

What does it mean to "certify a key"

I'm going through a TPM tutorial at https://google.github.io/tpm-js/#pg_keys It says: Hierarchies differ by when their seeds are created and by who certifies their primary keys. and Generally ...
user avatar
  • 379
0 votes
0 answers
118 views

TPM and Windows Credential Manager

I'm working on a project that needs to store some encrypted data along with their keys on a Windows 10 computer. The problem is obviously how to protect the keys. My original idea was to use DPAPI ...
user avatar
  • 1
1 vote
1 answer
207 views

Is a cold-boot-attack on a bitlocker key in TPM still possible, if I use the TPM with a different drive in the meantime?

I have a laptop with the system disk encrypted by Bitlocker. Bitlocker is configured to require a pre-boot pin, and unlocks by TPM. The recovery key is required to unlock and is not available atm. The ...
user avatar
  • 11
0 votes
0 answers
96 views

TPM2-TOOLS: Dump TPM2 Attestation Key after it has been created

Suppose I have created an Attestation key (AK) and dumped the public portion for my use. Further using TPM2 Evict Control, I make the attestation key persistent on an address in TPM. $ tpm2_createak -...
user avatar
  • 3
2 votes
1 answer
314 views

Are there any Linux distributions with enabled TPM2 and full disk encryption setups

I have been searching the web to find a Linux distribution, preferrably a rolling release one as I'm otherwise hooked on the concepts in Arch Linux, with automated steps to setup full disk encryption (...
user avatar
  • 121
0 votes
0 answers
99 views

Can an OS implement Trusted Boot without TPM given Secure Boot?

Since Secure Boot authenticates software, the OS only needs to check hardware. The implementation I have in mind measures hardware and compares the result of the measurement to the value in an EFI ...
user avatar
  • 139
0 votes
2 answers
166 views

How to securely encrypt my computer and protect it from thieves and others

I did enabled Bitlocker encryption on my Windows 10 Pro Laptop. but it has TPM 2.0 chip installed and Because of that it DOES NOT actually Protecting me as someone JUST NEED TO CRACK 1 PASSWORD (...
user avatar
4 votes
1 answer
103 views

Is it possible to use HKDF in the TPM?

Is it possible to use HKDF in the TPM? My goal is to load in a master symmetric key and derive keys from that using HKDF. I see there are other KDF functions available, but no mention of HKDF.
user avatar
  • 43
0 votes
1 answer
194 views

Is it possible to protect browser credentials from malicious processes?

What items should be considered to create a browser that prevents all access to stored credentials by a malicious process? Hardware attacks being out of scope. Are there public projects addressing ...
user avatar
  • 183
2 votes
1 answer
198 views

Does Intel's vPro TME make a locked screen more secure?

This post seems on point but I didn't understand the answer enough to answer this question. Intel's vPro offers "Total Memory Encryption" (TME), which encrypts RAM and system bus data while ...
user avatar
  • 21
1 vote
1 answer
145 views

What's the feasibility of making a hostile TPM chip?

Among the things listed that a TPM chip can do I found something not like the others: Remote Attestation: ... This allows a third party to verify that the software has not been changed. But in a ...
user avatar
  • 1,090
0 votes
1 answer
239 views

Can I store an openssl generated public key on a TPM (2.0) device?

I've got an Infineon SLB9670 TPM module connected to a BeagleBone Board. I would like to carry out RSA signature verification on the board by using the TPM as a key store (storing the public key). W.r....
user avatar
  • 3
0 votes
1 answer
442 views

Why does Windows not enable TPM 2.0 parameter encryption to protect against bus sniffing of Bitlocker key?

Comes from Bitlocker, does additional authentication at startup with TPM device provide any extra security? You can sniff the key right from the bus currently: As the decryption happens automatically,...
user avatar
0 votes
1 answer
251 views

What stops a bad BIOS lying to the TPM?

I've learned that a TPM can supposedly attest to the state of a computer's BIOS being good. It does this by asking the BIOS to send a hash of its current state. So what stops a compromised BIOS from ...
user avatar
  • 1
1 vote
1 answer
751 views

Sealing a pass-phrase with the TPM and associating it with a file state

Is there a way to associate the state of an arbitrary file to a tpm2 PCR value? I want to seal a secret pass-phrase onto the TPM, and I want the TPM to be able to unseal it only if the file is not ...
user avatar
  • 13
3 votes
1 answer
2k views

Understanding TPM PCRs, PCR banks, indexes and their relations

I'm reading about TPM, and I'm currently thinking how to visualize their relationships. Basically, reading from https://link.springer.com/chapter/10.1007/978-1-4302-6584-9_12 (and the TPM documents) I ...
user avatar
  • 259
5 votes
1 answer
361 views

Since TPM firmware is updatable can it be exploited by malicious hardware actors?

I have been reading about TPM for months and one thing seems to be odd. I noticed that TPM firmware can be updated in certain brands. Like "Lenovo" or this link which links a bunch of brands....
user avatar
1 vote
1 answer
1k views

Using Hardware Encryption on NVME SSD used as the boot device

I have a question relating to implementing encryption of data at rest. This is possibly more suited to another stackexchange site, so please let me know where would be better to post if I'm a little ...
user avatar
  • 113
1 vote
2 answers
800 views

Would the new TPM policy in Windows 11 hinder dual booting?

This 'mandatory' TPM thing worries me… if Windows 11 absolutely wants to use the TPM and takes ownership of it, and secure boot becomes mandatory how could we dual boot to i.e. Linux? Also, what about ...
user avatar
1 vote
1 answer
211 views

Does a TPM chip simply replicate the BIOS function of checking platform integrity?

According to Wikipedia, The primary scope of TPM is to assure the integrity of a platform. In this context, "integrity" means "behave as intended", and a "platform" is ...
user avatar
2 votes
3 answers
320 views

Does / Can a HSM or TPM encrypt my private keys

I'm still not completely sure about the role of using an HSM or TPM on a device when it comes to storing private keys for security purposes. My use case would be using TLS with an embedded device ...
user avatar
0 votes
1 answer
221 views

How does a cloud based application use a TPM to authenticate hardware devices?

I have heard about this, but not sure how it would work. I would imagine that when you register the device, the public RSA key burnt into the chip would be shared. That way, if the application sends a ...
user avatar
2 votes
2 answers
250 views

Secure boot for devices which don't have hardware security element

I understand that Root of Trust is necessary for implementing a secure boot on a device. Root of Trust is strong and trust worthy if this comes from hardware security elements like HSM/TPM/.. So for ...
user avatar
2 votes
1 answer
317 views

How does a Certificate get associated to the private key pair? [duplicate]

I am new to SSL certs and trying to understanding once the certificate is imported into the Certificate Store (in Windows), how do we associate the private key pair to the certificate? Is that by ...
user avatar
  • 121
1 vote
1 answer
224 views

Security against local attack for remote FDE decryption?

Is there any remote FDE decryption that is resistant to an attacker that has local physical access? Tools like dracut-sshd need to store the private key used for the sshd server on the unencrypted ...
user avatar
  • 21
1 vote
0 answers
151 views

Hardware roots of trust nowadays

I find that names and terms used in relation to Trusted (Trustworthy, Confidential,..) Computing are highly interchanged and thus creating confusion for laymen as am I. Trusted Computing has been ...
user avatar
  • 105
1 vote
1 answer
850 views

Is it secure to automatically unlock encrypted system drive using the TPM PCR values?

A simple way of automatically decrypting system drive at boot time: clevis luks bind -d /dev/yourdrive tpm2 '{"pcr_ids":"4,5"}' systemctl enable clevis-luks-askpass.path When I ...
user avatar
2 votes
0 answers
137 views

Using TPM to generate certificates associated with different users on the same device

I plan to use the TPM to generate CSR's backed by a private key stored on the TPM. The CSR's will then be signed by an external HSM. Since a certificate is tied to a particular private key, how do you ...
user avatar
1 vote
1 answer
300 views

How can we use a symmetric key for signing data on TPM2.0?

I am trying to sign some data with a symmetric key AES128 on the TPM2. However, I get this error during the signing ERROR: Unknown key type, got: 0x25 ERROR: bad signature scheme for key type! ERROR: ...
user avatar
2 votes
2 answers
2k views

Can I safely disable and re-enable Secure Boot when Bitlocker is used in order to make a Forensic Image?

I am about to make a forensic image (using dc3dd from OSFClone) of two laptops and in this specific case I'd like to startup using an bootable USB stick with OSFClone and image the disk to an external ...
user avatar
  • 6,195
1 vote
1 answer
153 views

Use of SoftHSM2 in commercial products

I came across SoftHSM2 from OpenDNSSec(BSD license) which is a drop-in replacement for HSM except that SoftHSM2 only lacks physical security. Also, being the fact that PKCS#11 is the standard ...
user avatar
8 votes
2 answers
2k views

TPM or OpenSSL for key generation?

I would like to know which method is more secured. I know that they can be combined, but I would like to understand why TPM or OpenSSL might be a more secure technique to generate (encryption, ...
user avatar
0 votes
0 answers
182 views

Better security for storing certificates in LUKS or softhsm?

What is the best place to store certificates and keys which are confidential and sensitive? As I understand LUKS is fine and kernel transparently handles encryption/decryption. Also, the LUKS volume ...
user avatar
2 votes
1 answer
106 views

How can I protect myself from intercepting messages sent to the server?

I want to collect certain data from my application using the driver and transfer it to the server to check its integrity. And I want to sign these packages using TPM to avoid forgery. However, a user ...
user avatar
1 vote
1 answer
267 views

How secure is Heads for detecting tampering or infection of firmware or boot sector? (Pureboot)

I'm thinking of getting a Librem laptop with Pureboot which uses Heads (with the Librem key) for tamper detection. But I've heard rumours that there are weaknesses or vulnerabilities so I wanted to ...
user avatar
  • 11
1 vote
0 answers
118 views

Can I damage my hardware TPM by improperly treating it?

I read somewhere that TPMs are not hard to be rendered useless or broken by improper use of its API, considering I have complete user access to it via the command line. Is that true? Could you give an ...
user avatar
  • 105
6 votes
2 answers
14k views

What really is the difference between firmware TPM and a discreet one and should it be trusted more?

What really is the difference between a physical TPM and any implementation of a fTPM? I get that both adhere to the same specification and in my mind should be the same thing, but then, I don't ...
user avatar
  • 105

1
2 3 4 5