Questions tagged [tpm]
A Trusted Platform Module (TPM) is a secure coprocessor found in some x86-based computers that provides cryptographic operations and system integrity measurements.
256
questions
0
votes
0
answers
14
views
Using TPM to unlock LUKS/dm-crypt volume
I am trying to understand the risks of configuring passwordless decryption via TPM of a LUKS/dm-crypt system with something like:
systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+1+2+3+4+5+7+8 /...
- 241
1
vote
0
answers
28
views
Can I set up a TPM2 policy that ANDs multiple OR policies?
I'd like to define a TPM access policy that allowlists multiple different values for certain PCRs. Hence, i'd like a policy like this:
(PolicyOR(PolicyPCR(value1,pcr4),PolicyPCR(value2,pcr4),PolicyPCR(...
- 111
0
votes
0
answers
28
views
PCR to prevent TPM2 key unsealing in case of rogue DMA devices connected?
Security threat: physical theft of a laptop and a server that use TPM2 auto unlock FDE with LUKS. In both cases the TPM checks against some PCRs before unsealing the key. The laptop prompts for a TPM ...
- 63
1
vote
0
answers
62
views
Using a TPM for host authentication during PXE boot
I have a stateless machine that is PXE booting from some host, and I'm curious if there is some clever way to achieve host authentication by only using the TMP (No UEFI Secure Boot).
For obvious ...
- 549
1
vote
0
answers
67
views
How to wrap/unwrap with TPM2 endorsement key
I have a remote client A which wants to communicate securely with a server B having a discrete TPM. My understanding is that each TPM normally come with a endorsement key from manufacture like ...
- 11
0
votes
0
answers
22
views
Is TPM NV deletion protection possible?
I want to implement a counter that cannot be tampered with using TPM.
It seems that it is possible to force data not to be written by enabling only nv-increment.
However, if nv is deleted with nv-...
0
votes
0
answers
114
views
Bitlocker TPM + PIN vs password without TPM
I keep reading how it's best to use Bitlocker's full disk encryption with a TPM + PIN instead of just a passphrase twithout a TPM but I've been wondering why.
Assuming that a very strong password is ...
1
vote
1
answer
207
views
How does a TPM module protect keys LUKS keys on Linux
I'm looking into hardening an embedded device using TPM2 with an encrypted root (/) Linux partition. I've found various articles explaining how to embed LUKS keys into the TPM (eg this one). Unless ...
- 111
0
votes
0
answers
87
views
Advice on encryption setup
I've been trying to get a reliable, and decently secure setup on a device for a little while now, and I feel like I may be overthinking some things but I am unsure.
Just to clear things up, this is ...
- 143
1
vote
1
answer
122
views
What are the security differences between TPM1.2, TPM2.0, Intel PTT, and AMD fTPM?
As far as I am aware, to the OS, PTT, and fTPM are indistinguishable from TPM2.0. What I am curious about, are the physical security differences between the different TPM providers. A dedicated TPM2 ...
- 143
1
vote
0
answers
25
views
When can TPM_Start(ST_Clear) be issued to a TPM?
TPM 1.2 has an NVRAM permission attribute called TPM_NV_PER_WRITE_STCLEAR. The TPM 1.2 specification describes it as
The value is writable until a write to the specified index with a datasize of 0 is ...
- 247
1
vote
0
answers
70
views
How does a TPM verify the identity of the calling process/service?
Any application can use a TPM chip to securely create and store cryptographic keys.
For example for Digital Rights Management (DRM) or for prevention of cheating in online games.
However, how can a ...
- 11
0
votes
1
answer
143
views
Does faulTPM defeat the LUKS-based FDE with a passphrase?
The recent faulTPM paper (https://arxiv.org/pdf/2304.14717v1.pdf) deals mostly with Bitlocker and only mentions LUKS to note the differences.
The authors state:
With a passphrase, however, the same ...
- 143
3
votes
1
answer
414
views
How can an application, using Apple's Secure Enclave on macOS or TPM on Windows, protect itself from other applications accessing its private keys?
I'm interested in using Apple's Secure Enclave on macOS or TPM on Windows to protect cryptographic keys used by an application from being accessed by other applications running with the same or higher ...
- 56
3
votes
2
answers
276
views
TPM - ECC based encryption / decryption using the public key
Our device comes with a device certificate which was signed with our private registration authority (CA). The private key (type ECC) was generated on the device itself - to be more specific directly ...
- 261
0
votes
1
answer
244
views
Can TPM be used for SSL Client Certificates for an existing applications?
Is it possible to use TPM for SSL Client Authentication (with a client certificate) and thereby ensure on the server/backend side knows, that the request comes from the specific client machine (even ...
- 361
0
votes
0
answers
86
views
TPM tss2 certificate signing request sign by CA
I am trying to sign certificate by CA which generated by CA. But I am facing below error code while singing.
Generate certificate:
# tpm2tss-genkey -a rsa -s 2048 mykey
# openssl req -new -engine ...
- 113
3
votes
1
answer
117
views
Laptop TPM with physical presence key operations?
It seems most systems have a TPM 2 module in them now, and it seems those modules often have a physical presence pin. Are these pins actually used by any typical laptop manufactures?
I have a laptop ...
- 31
2
votes
1
answer
139
views
Are TPM PCRs volatile, non-volatile, or both?
Do PCRs (Platform Configuration Registers) on TPMs (Trusted Platform Modules) retain their data on reboot?
I'm trying to find out if all (or some) of the PCRs on a TPM are volatile (will loose their ...
- 978
0
votes
0
answers
171
views
Can you require both a password and a smart card to unlock a bitlocker drive?
I seen you can associate a smart card when you encrypt the drive with bitlocker, but I am not sure if ...
You can unlock with a smart card as an alternative to your password that you set (not the ...
- 140
0
votes
0
answers
94
views
disk or file encryption using the TPM2_EncryptDecrypt2 command of the TPM
Are there any disk/file encryption methods that utilize the TPM2_EncryptDecrypt2 command? All TPM disk encryption tutorials I can find use the TPM to secure the disk encryption key, and not use the ...
- 133
0
votes
1
answer
75
views
Security and practicality of passing secrets to services running as non-privileged user
I strongly dislike and mistrust the practice to store secrets in plain text files for unattended access by services.
This is increasingly less of an issue in modern deployments where secrets are ...
- 113
2
votes
1
answer
183
views
TPM PCRs not reset on TPM reset or on reboot
I have a Raspberry Pi with a TPM chip, where I use the TPM for disk encryption. The disk encryption password is sealed to the TPM using PCR register 0. I extend the PCR on the start of the system with ...
- 133
0
votes
1
answer
341
views
What threats can the use of a TPM by a password manager mitigate?
This question is about the use of a TPM by a password manager used by an end-user on a PC to store and use passwords to log in to web sites and other things that are protected only by a password.
...
- 569
0
votes
0
answers
58
views
External and internal OS whole disk encryption using TPM 2.0 module for centos
I am new to disk encryption, I have gone through the encryption topic basic, need to do whole disk encryption using TPM2.0 on cent OS server along with some external HDD or ssd disk attached to the ...
1
vote
0
answers
84
views
TPM FAPI sealing data inside /dev
I am using TPM simulator in my local VM to test FAPI API and am able to seal the important data inside directory ~/.local/share/tpm2-tss/user/keystore as per the path mentioned in config file /etc/...
- 161
1
vote
0
answers
67
views
Symmetric key importance During encrypt and decrypt [closed]
I am performing a small command line operation the goal is to generate a symmetric key using openssl and store the key in TPM FAPI keystore.
After modifying the symmetric key, the decryption should ...
- 161
1
vote
0
answers
70
views
Is there any use case of DAA (Direct Anonymous Attestation) in TPM?
I want to know the use cases of DAA (Direct Anonymous Attestation) in the real world.
- 11
2
votes
1
answer
493
views
Store/Secure openssl cert and key file in TPM2.0
I have my TPM2.0 connected to my raspberry pi. I generated a Cert file and Private key using openssl. These files are used to connect MQTT with TLS. How do I store/secure these files in/with the TPM ...
- 23
1
vote
0
answers
87
views
The 3-level hierarchy of keys in TPM 2.0
I have a task to create the 3-level RSA key hierarchy (with wolfTPM library), where keys of the 2nd and the 3rd levels are imported keys.
Here are the steps that I follow:
Generate a primary key on ...
- 111
0
votes
1
answer
202
views
Why does my TPM-chip report to support symmetric encryption algorithms, while not supporting symmetric encryption
I would like to use my TPM chip to symmetrically encrypt some data, but sadly the tpm2_getcap commands command states that symmetric encryption is not supported by my chip.
The thing I find unusual is ...
- 133
0
votes
1
answer
175
views
How does a TPM decide if an application can get cryptographic services?
There is an answered question which asks about the specifics and the answers are technical. I am looking for a conceptual answer in a ELI5 manner.
A TPM is a hardware chip which stores critical keys. ...
1
vote
2
answers
70
views
Autogenerated PINs
PINs secured by TPM or similar hardware are secure even if short and only numeric because the TPM can throttle and lock after several attempts. I'm concerned about PIN reuse. I suspect most people are ...
- 131
1
vote
1
answer
173
views
What is the reason why Microsoft decided not to provide updates when bypassing TPM requirements?
I understand TPM is quite an important tool for security, but a lot of the updates not being offered should not be related to TPM. Not offering updates to people who bypass TPM on Windows 11 and also ...
- 87
1
vote
2
answers
283
views
What makes TPM "trusted"?
I was just going through TPM Overview and What makes TPM chip Endorsement Key Non-migratable? but it seems like the "trust" is a matter of "trusting" the manufacturer to not be ...
0
votes
1
answer
449
views
fTPM more secure than TPM when using Bitlocker?
Is fTPM more secure than a real TPM module when using Bitlocker?
As far as I know, you should enable pre-boot authentication if you use a TPM module that is plugged separately onto the motherboard to ...
- 101
1
vote
1
answer
82
views
Is it possible to allow only a certain secure USB boot media to boot an UEFI system?
I want to restrict all USB boot media from my system, except for a certain USB boot drive that I declare secure via a certain key.
Is this possible using UEFI/Secure Boot/TPM? Maybe via TPM? TPM gets ...
- 1,413
3
votes
1
answer
438
views
Use platform TPM as U2F for web applications
The Problem:
Use the platform TMP of my Windows Laptop/PC (no external device or USB token) as U2F in a web application to check if it is a known device.
My intended solution:
I need to store/create ...
- 81
0
votes
1
answer
390
views
How to preserve key in TPM 2.0
I've been looking into TPM 2.0 with .NET (TSS.MST), and I don't understand how to preserve key upon application rerun. TSS.MST provides a binary simulating the TPM2.0 device and the app is connecting ...
1
vote
1
answer
944
views
TPM use without secure boot
I've been asked to improve the security of my company's iot device, and encrypt a storage partition. It's a general purpose arm based device, and currently can boot from a variety of sources (USB, ...
- 111
0
votes
0
answers
178
views
Microsoft Pluton Security Chip - Specs and API?
Microsoft introduced a new security chip dubbed Pluton that is ought to become mandatory for systems running Windows (11 and forward).
AMD has already implemented or is about to implement the chip as ...
- 191
1
vote
2
answers
595
views
TPM Endorsement Key usage in secure and trusted boot
Taking into account a Root of Trust in a device using a TPM.
My understanding is that the bootloader, firmware, operating system, applications etc. are all verified on startup by validating signatures ...
- 267
3
votes
1
answer
601
views
Secure boot after an OTA update confusion
My understanding is that secure boot works by verifying each stage in the boot process before proceeding. So first, UEFI or booting firmware will validate the signature of the bootloader, then kernel, ...
- 267
0
votes
4
answers
916
views
Can TPM2 disk encryption protect data after full server theft?
I read about TPM2 with PCR locking full-disk encryption from different sources. For example [1]. What I can't understand is how much does this protect from full server theft.
If we assume that TPM2 ...
- 614
0
votes
1
answer
2k
views
VeraCrypt New Processor TPM Message Issue
I upgraded my processor and now I get this message when starting my computer:
We detected a new processor which will change the data/structure of the storage space for firmware TPM. If you did not ...
1
vote
1
answer
212
views
What is the point of an OS (Win11) requiring a TPM (or vTPM) beyond a layer of DRM?
Windows 11 requiring a TPM of some sort seems more like a DRM preventing me from duplicating a W11 Virtual Machine on multiple systems and distributing it versus any tangible benefit to the end-user.
...
1
vote
1
answer
196
views
Prove Private Key came from Apple Secure Enclave
With TPM 2.0, it's possible to prove that the private key of an asymmetric key pair came from a TPM device (and thus is effectively inaccessible).
Is this possible with Apple's Secure Enclave on macOS?...
- 113
3
votes
2
answers
3k
views
Usage of TPM PCRs in Linux
Where can I find the list of what each PCR "represents" in the TPM for a Linux OS? The official guide I found (https://trustedcomputinggroup.org/wp-content/uploads/...
- 131
1
vote
1
answer
180
views
What does it mean to "certify a key"
I'm going through a TPM tutorial at https://google.github.io/tpm-js/#pg_keys
It says:
Hierarchies differ by when their seeds are created and by who certifies their primary keys.
and
Generally ...
- 419
1
vote
1
answer
745
views
Is a cold-boot-attack on a bitlocker key in TPM still possible, if I use the TPM with a different drive in the meantime?
I have a laptop with the system disk encrypted by Bitlocker. Bitlocker is configured to require a pre-boot pin, and unlocks by TPM. The recovery key is required to unlock and is not available atm. The ...
- 11