Questions tagged [tpm]

A Trusted Platform Module (TPM) is a secure coprocessor found in some x86-based computers that provides cryptographic operations and system integrity measurements.

Filter by
Sorted by
Tagged with
0
votes
0answers
41 views

“Something you have” on a multi-user device - what is the opinion regarding the NIST AAL3 definition?

The NIST AAL3 specification requires In order to authenticate at AAL3, claimants SHALL prove possession and control of two distinct authentication factors through secure authentication ...
1
vote
1answer
57 views

openssl: does -keyform engine enables accessing TPM persistent handles with any key arguments ? Even with third party plugin like CMP?

If I use the tpm2tss-engine coupled with openssl, can I substitute, optionally any file path to a private key by a TPM persisent handle ? Will it work with extensions, like CMP for OpenSSL, for ...
0
votes
0answers
36 views

Purpose of TPM PCR banks #12, 13 and 14

Microsoft documentation mentions the following registers: PCR 12: Data events and highly volatile events PCR 13: Boot Module Details PCR 14: Boot Authorities Could someone provide more details as to ...
0
votes
0answers
48 views

Changing MOK database does not trigger BitLocker recovery

I am running BitLocker with the following PCR validation profile: TPM And PIN: ID: {XXX-XXX-XXX-XXX-XXX} PCR Validation Profile: 0, 1, 2, 3, 4, 5, 6, 7, 11 However, using ...
0
votes
0answers
55 views

What is TPM_takeownership

I read the documentation about the command TPM_takeownership used for TPM 2.0. Does it make the currently logged Linux user the owner of the TPM? If so, what are the consequences of this ownership? ...
1
vote
0answers
60 views

Practicality of Direct Anonymous Attestation [closed]

DAA (Direct Anonymous Attestation) is not the only scheme to achieve anonymous attestation. In general, these schemes allow an entity to stay anonymous throughout the attestation process. The concern ...
2
votes
1answer
56 views

RAID + IEEE1667 + TPM + UEFI

Windows Server using a IEEE-1667 drive allows hardware based encryption on the fly. What are our options when using two disks with a RAID controller, in order to achieve redundancy and parity (T10-...
-1
votes
2answers
217 views

How can BitLocker be considered safer, if it doesn't asks for a key during boot?

I've been using VeraCrypt / TrueCrypt for years. Now, with a new computer (having Windows 10 Pro) I can consider BitLocker. But, either I am complete ignorant and don't see something awfully obvious ...
0
votes
0answers
40 views

Windows 10 invalidated PIN for three accounts out of four

I have a Windows 10 Pro 1903 with four accounts: two are for adult users and two for children one adult account is admin account, three remaining are standard users accounts, all four are Microsoft ...
0
votes
0answers
14 views

DRM using TPM on Computers deployed offline (OS Windows 10 with TPM 2.0) [duplicate]

I've been asked to do a sort of copy protection (licensing) to an existing software project, using TPM 2.0 on Windows. What is asked for is that a specific software is only allowed to run on the ...
2
votes
0answers
31 views

Is it possible to securely transfer a symmetric key to a VM instance with the use of vTPM?

We have a physical Xeon host (bare metal - BM host) with a hardware TPM installed on it. The BM host's attestation status is established at through boot-time measurements captured and written to the ...
0
votes
0answers
295 views

Use TPM 2.0 to automatically decrypt the SD Card in Raspbian OS

I'm a college student trying to complete the first part of a rather large project, but I'm new to TPM, and Linux. What I'm trying to do is have TPM handle automatic decryption of the root ext4 ...
0
votes
2answers
230 views

Bitlocker/Filevault and VeraCrypt together?

I'm researching ways to make the most secure encryption for additional fixed drives to protect against unknown vulnerabilities, side channel attacks, etc. Basically, securing the data beyond just a ...
1
vote
1answer
198 views

BeagleBoneBlack, TPM and uBoot

I'm using BBB in my project. I need to prevent any changes to the software running on it. I've been reading about uBoot and TPM. But if I understand everything correctly, this can't be implemented ...
0
votes
0answers
57 views

What are the security protections in using a TPM generated VSC to create a CSR

I am extremely new to the field of information security but was given a project to create a secure TLS certificate signed by our CA for a new security process. I found this thread (How to generate a ...
0
votes
0answers
205 views

TLS 1.3 protected by TPM 2.0

I have seen some implementation of TLS using TPM 2.0 like the tpm2-tss-engine engine which can be used to protect the server private key associated with the certificate and sign with it inside the ...
2
votes
0answers
79 views

Perform quote operation over NV-memory in TPM

It is known that is possible to define an NV Extend Index which has a behaviour similar to a PCR (Platform Configuration Register) and it is possible to modify it using TPM2_NV_Extend() operation. ...
0
votes
0answers
143 views

TPM 2.0 Bus Encryption / Decryption?

It seems that in TPM 2.0 a call to TPM2_StartAuthSession() is able to start a decrypt/encrypt session. However, the caller forwards all the key generation material to the TPM in plaintext, and then ...
1
vote
1answer
125 views

Bitlocker, does additional authentication at startup with TPM device provide any extra security?

Will enabling additional authentication on startup provide any extra security with Bitlocker? At the moment, my laptop boots straight into a Windows login where I use a pin. If I chose to not use pin, ...
1
vote
3answers
1k views

TPM 1.2 or Intel PTT

While configuring a Lenovo Thinkpad T450s I stumbled across the option choosing how one would like to implement TPM. It gives the options: Hardware TPM chip with TPM 1.2 mode Intel PPT with TPM 2.0 ...
1
vote
2answers
207 views

Device security in IOT

I am working on an IOT device that sends data to the server after authenticating itself to the server. Is there a way to safely store my device's credentials for logging onto the main server and ...
0
votes
0answers
59 views

Is it possible to use wolfTPM SDK to talk to a TPM 2.0 chip from within a docker container?

Is it possible to use wolfTPM SDK to talk to a TPM 2.0 chip from within a Docker container?
1
vote
0answers
55 views

Is it possible to use the SunPKCS11 provider to talk to a TPM2.0 chip using TPM2-PK11 library?

I have a TPM 2.0 chip which contains an RSA signing key (AIK) and I would like to sign a message using Java and I was wondering whether it would be possible to use the SunPKCS11 provider to interface ...
0
votes
1answer
139 views

Device authentication, common method

My question is: What are some standard device authentication methods, in a scenario when: The desktop computer is being authenticated on web service I provide the .exe on the desktop I control the ...
0
votes
0answers
60 views

What is the difference between SGX and TPM? [duplicate]

What is the difference between Intel Guard Extensions (SGX) and Trusted Module Platform (TPM)? This answer tells you what the similarities are and what the features are, but not explicitly what the ...
0
votes
0answers
62 views

Enclosed FDE, Bridge & chipset FDE. what is the difference to SED

I was reading hardware based encryption, and found out that they are basically of 3 types. 1) SED - Encryption/Decryption done by the drive circuitry. Unlocked via Pre boot authentication. Can use ...
2
votes
1answer
161 views

Where to store signing key in TPM

I'm using TPM 2.0 to do a remote attestation for a computer. In order to do that you have to generate a signing key from a primary key. This generate a public key and an encrypted private key. As per ...
4
votes
1answer
371 views

Purpose of TPM “ownership” and “owner password”

I have a laptop with TPM 2.0, dual-booting Windows 10 and Linux. By default, Windows automatically takes ownership of the TPM with a throwaway password, but can be configured to store it in the ...
0
votes
1answer
242 views

Asymmetric/Symmetric Encryption of a TPM key hierarchy

I know that keys in a TPM key hierarchy are encrypted with their parent keys. But I read that those parent keys (for instance an asymmetric SRK) need to have some symmetric secret for said encryption. ...
1
vote
0answers
171 views

Key Hierarchies in TPM 2.0

I am currently trying to figure out just how key hierarchies in a TPM 2.0 work. I read that there are four possible hierarchies (storage, endorsement, platform, null). I also read, that these ...
1
vote
0answers
73 views

using sha256 to check for boot tampering

Consider the following machine: Dual Boots to two OSes, OS "A" and OS "B" OS "A" is trusted The bios is trusted. The root partition of OS "A" is encrypted OS "A" doesn't support secure boot OS "B" is ...
2
votes
1answer
96 views

Can a TPM chip check if the bios is still in it's factory setting?

Can TPM (trusted platform module) be used to verify if a used laptop's bios, the bootloader and related components have not been tampered with in the past, i. e. whether those components are still in ...
5
votes
0answers
506 views

What's the difference between Secure Boot and Attestation?

What's the exact difference between secure boot and device attestation. Nowadays with secure devices both are used, even at the same time, when in the core they do similar things, which is ...
2
votes
1answer
709 views

FIDO2 on Windows: Why do I need a TPM?

I just installed the Windows 10 1809 update, which includes support for FIDO2 passwordless sign-in. I own a Yubikey 5, which supports this standard. However, I am not able to set up Windows Hello, a ...
2
votes
1answer
356 views

Can I prove the relation between AIK and EK without asking to the TPM 2.0?

The Endorsement Key (EK), the Public part, is available directly on the TPM chip, I know that you can generate an AIK key and then sign with that key, the hash must be generated by the TPM. The idea ...
1
vote
1answer
153 views

TPM and remote attestation

I am currently trying to figure out just how remote attestation for a TPM works in combination with the PCR-values. Is it true that the PCR values are only measured on system boot and cannot be ...
1
vote
1answer
197 views

How to protect devices that are reliant on Bitlocker and a password without TPM?

In working with a number of non-profit organizations, devices such as laptops used by staff are encrypted using Bitlocker. Unfortunately since the devices (often donated) do not feature TPM, Bitlocker ...
1
vote
1answer
71 views

Validate individual hardware components process

UFEI Secure Boot does not validate individual hardware components (SSD/hard drive, networking chips/card, video card, etc.) that can get infected. Is there anything currently available that's able to ...
5
votes
1answer
3k views

Use TPM2.0 to securely decrypt the hard drive in Linux — unattended

I spent several days trying to figure out how to securely decrypt a hard drive on remote location using TPM2.0 in Linux. I'm no security expert and this is my first battle with TPM2.0. I learned a lot,...
1
vote
0answers
229 views

With TPM how are the initial PCR values seeded with 'good' values?

I am trying to learn more about trusted boot / trusted platform modules and I understand about platform configuration values being a measurement of a 'good' configuration signed by a key locked from ...
2
votes
1answer
282 views

Is a TPM which boots a full-disk-encrypted computer to login secure?

Currently the laptops in use are encrypted using Pre-Boot-Authentication, so the entire disk is encrypted. A user has to enter a password before booting the operating system. A new concept suggests ...
2
votes
1answer
124 views

For a “normal” computer user, does it make a difference to have a good entropy source?

Let's take, for example, Linux. From my understanding, there are different sources and different ways that can be used to gather entropy (RNG daemon, Intel rrandr, TPM, etc). Some produce entropy that ...
0
votes
0answers
100 views

How common are computers with a TPM

When writing software, is it worth targeting a TPM for increased security? That boils down to: how common are normal business desktop and laptop computers with a TPM (not servers, not so interested ...
3
votes
0answers
120 views

TPM - Device Softwareupdate - What happens to my sealed key?

Imagine having a device that has a TPM (Trusted Platform Module). This TPM is used to store keys. Some of these keys are sealed to PCR constraints, meaning that they can only be opened if the PCRs ...
10
votes
3answers
3k views

How does Bitlocker + TPM prevent me seeing the HDD contents with another OS?

I've googled the heck out of this, and have read multiple related questions on this site, but I'm still missing a crucial piece of the puzzle. I have a (work) laptop with Win10 Pro which is encrypted ...
0
votes
0answers
942 views

Can Yubikey complement a TPM chip?

Does the functionality of an external hardware key overlaps 100% with the one provided by an embedded security chip on a laptop? Or can they complement each other? Although I assume an external key ...
2
votes
1answer
1k views

What is the safest way to use Bitlocker with TPM?

I started using bitlocker yesterday and I have a TPM2.0 in my laptop. I enabled the option to enter a pin when starting and I enabled the option to use AES256 before encrypting. I don't really ...
2
votes
0answers
618 views

Use TPM 1.2 to store the private key of a certificate

Let's say I have an application that requires certificates (HTTPS, MQTTs, etc.) due to the use of TLS. I'm planning to build my own tier-1 PKI hierarchy with my own company CA signing device ...
6
votes
1answer
1k views

How does full memory encryption in newer processes protect against DMA attacks?

Upcoming Intel CPUs have TME, current AMD processors have SME. These are full-memory encryption techniques to protect against physical attacks such as cold boot attacks. Both support encrypting the ...
1
vote
1answer
259 views

How can a Trusted Platform Module “enhance network security”?

I've recently bought a motherboard, which has support for a Trusted Platform Module. On the topic, the manual states the following: This connector supports Trusted Platform Module (TPM) system, ...