Questions tagged [tpm]

A Trusted Platform Module (TPM) is a secure coprocessor found in some x86-based computers that provides cryptographic operations and system integrity measurements.

Filter by
Sorted by
Tagged with
1
vote
1answer
59 views

What is the point of an OS (Win11) requiring a TPM (or vTPM) beyond a layer of DRM?

Windows 11 requiring a TPM of some sort seems more like a DRM preventing me from duplicating a W11 Virtual Machine on multiple systems and distributing it versus any tangible benefit to the end-user. ...
0
votes
0answers
15 views

Prove Private Key came from Apple Secure Enclave

With TPM 2.0, it's possible to prove that the private key of an asymmetric key pair came from a TPM device (and thus is effectively inaccessible). Is this possible with Apple's Secure Enclave on macOS?...
0
votes
0answers
39 views

What is the advantage of AES key warp as opposed to adding a random nonce? [migrated]

I'm interested in methods of wrapping an AES DEK (Data Encryption Key) using AES KEK (Key Encryption Key). Is there an advantage to using AES key wrap (rfc3394) as opposed to simply adding a random ...
0
votes
0answers
39 views

TPM vs TCM - InTune and BitLcoker compliance in China

It appears that TPM is banned in China, therefore, Dell laptops shipped to China are equipped with TCM chips instead of TPM. How secure is TCM? gov backdoors? Wondering how does if devices with TCM ...
1
vote
1answer
38 views

Usage of TPM PCRs in Linux

Where can I find the list of what each PCR "represents" in the TPM for a Linux OS? The official guide I found (https://trustedcomputinggroup.org/wp-content/uploads/...
2
votes
1answer
54 views

What does it mean to "certify a key"

I'm going through a TPM tutorial at https://google.github.io/tpm-js/#pg_keys It says: Hierarchies differ by when their seeds are created and by who certifies their primary keys. and Generally ...
0
votes
0answers
47 views

TPM and Windows Credential Manager

I'm working on a project that needs to store some encrypted data along with their keys on a Windows 10 computer. The problem is obviously how to protect the keys. My original idea was to use DPAPI ...
0
votes
1answer
81 views

Is a cold-boot-attack on a bitlocker key in TPM still possible, if I use the TPM with a different drive in the meantime?

I have a laptop with the system disk encrypted by Bitlocker. Bitlocker is configured to require a pre-boot pin, and unlocks by TPM. The recovery key is required to unlock and is not available atm. The ...
0
votes
0answers
65 views

TPM2-TOOLS: Dump TPM2 Attestation Key after it has been created

Suppose I have created an Attestation key (AK) and dumped the public portion for my use. Further using TPM2 Evict Control, I make the attestation key persistent on an address in TPM. $ tpm2_createak -...
0
votes
0answers
122 views

Are there any Linux distributions with enabled TPM2 and full disk encryption setups

I have been searching the web to find a Linux distribution, preferrably a rolling release one as I'm otherwise hooked on the concepts in Arch Linux, with automated steps to setup full disk encryption (...
0
votes
0answers
71 views

Can an OS implement Trusted Boot without TPM given Secure Boot?

Since Secure Boot authenticates software, the OS only needs to check hardware. The implementation I have in mind measures hardware and compares the result of the measurement to the value in an EFI ...
0
votes
2answers
127 views

How to securely encrypt my computer and protect it from thieves and others

I did enabled Bitlocker encryption on my Windows 10 Pro Laptop. but it has TPM 2.0 chip installed and Because of that it DOES NOT actually Protecting me as someone JUST NEED TO CRACK 1 PASSWORD (...
4
votes
1answer
81 views

Is it possible to use HKDF in the TPM?

Is it possible to use HKDF in the TPM? My goal is to load in a master symmetric key and derive keys from that using HKDF. I see there are other KDF functions available, but no mention of HKDF.
0
votes
1answer
129 views

Is it possible to protect browser credentials from malicious processes?

What items should be considered to create a browser that prevents all access to stored credentials by a malicious process? Hardware attacks being out of scope. Are there public projects addressing ...
3
votes
1answer
114 views

Does Intel's vPro TME make a locked screen more secure?

This post seems on point but I didn't understand the answer enough to answer this question. Intel's vPro offers "Total Memory Encryption" (TME), which encrypts RAM and system bus data while ...
1
vote
1answer
129 views

What's the feasibility of making a hostile TPM chip?

Among the things listed that a TPM chip can do I found something not like the others: Remote Attestation: ... This allows a third party to verify that the software has not been changed. But in a ...
0
votes
1answer
151 views

Can I store an openssl generated public key on a TPM (2.0) device?

I've got an Infineon SLB9670 TPM module connected to a BeagleBone Board. I would like to carry out RSA signature verification on the board by using the TPM as a key store (storing the public key). W.r....
0
votes
0answers
300 views

Why does Windows not enable TPM 2.0 parameter encryption to protect against bus sniffing of Bitlocker key?

Comes from Bitlocker, does additional authentication at startup with TPM device provide any extra security? You can sniff the key right from the bus currently: As the decryption happens automatically,...
0
votes
1answer
217 views

What stops a bad BIOS lying to the TPM?

I've learned that a TPM can supposedly attest to the state of a computer's BIOS being good. It does this by asking the BIOS to send a hash of its current state. So what stops a compromised BIOS from ...
1
vote
1answer
402 views

Sealing a pass-phrase with the TPM and associating it with a file state

Is there a way to associate the state of an arbitrary file to a tpm2 PCR value? I want to seal a secret pass-phrase onto the TPM, and I want the TPM to be able to unseal it only if the file is not ...
3
votes
1answer
784 views

Understanding TPM PCRs, PCR banks, indexes and their relations

I'm reading about TPM, and I'm currently thinking how to visualize their relationships. Basically, reading from https://link.springer.com/chapter/10.1007/978-1-4302-6584-9_12 (and the TPM documents) I ...
5
votes
1answer
282 views

Since TPM firmware is updatable can it be exploited by malicious hardware actors?

I have been reading about TPM for months and one thing seems to be odd. I noticed that TPM firmware can be updated in certain brands. Like "Lenovo" or this link which links a bunch of brands....
1
vote
1answer
748 views

Using Hardware Encryption on NVME SSD used as the boot device

I have a question relating to implementing encryption of data at rest. This is possibly more suited to another stackexchange site, so please let me know where would be better to post if I'm a little ...
1
vote
1answer
549 views

Would the new TPM policy in Windows 11 hinder dual booting?

This 'mandatory' TPM thing worries me… if Windows 11 absolutely wants to use the TPM and takes ownership of it, and secure boot becomes mandatory how could we dual boot to i.e. Linux? Also, what about ...
1
vote
1answer
176 views

Does a TPM chip simply replicate the BIOS function of checking platform integrity?

According to Wikipedia, The primary scope of TPM is to assure the integrity of a platform. In this context, "integrity" means "behave as intended", and a "platform" is ...
2
votes
3answers
205 views

Does / Can a HSM or TPM encrypt my private keys

I'm still not completely sure about the role of using an HSM or TPM on a device when it comes to storing private keys for security purposes. My use case would be using TLS with an embedded device ...
0
votes
1answer
186 views

How does a cloud based application use a TPM to authenticate hardware devices?

I have heard about this, but not sure how it would work. I would imagine that when you register the device, the public RSA key burnt into the chip would be shared. That way, if the application sends a ...
2
votes
2answers
175 views

Secure boot for devices which don't have hardware security element

I understand that Root of Trust is necessary for implementing a secure boot on a device. Root of Trust is strong and trust worthy if this comes from hardware security elements like HSM/TPM/.. So for ...
0
votes
0answers
93 views

PKCS#11 interface to work with Virtual TPM

I'm new to virtualization and hypervisor environment. Is it possible to use PKCS#11 interface in virtual machines that are managed by a hypervisor such as Xen or similar? This question is that in a ...
1
vote
1answer
263 views

How does a Certificate get associated to the private key pair? [duplicate]

I am new to SSL certs and trying to understanding once the certificate is imported into the Certificate Store (in Windows), how do we associate the private key pair to the certificate? Is that by ...
0
votes
1answer
183 views

Security against local attack for remote FDE decryption?

Is there any remote FDE decryption that is resistant to an attacker that has local physical access? Tools like dracut-sshd need to store the private key used for the sshd server on the unencrypted ...
1
vote
0answers
115 views

Hardware roots of trust nowadays

I find that names and terms used in relation to Trusted (Trustworthy, Confidential,..) Computing are highly interchanged and thus creating confusion for laymen as am I. Trusted Computing has been ...
0
votes
0answers
34 views

How can a hardware-based TEE supplement TPMs? [duplicate]

Recent years had seen a rise in many open-sourced projects developing tools to support program execution in TEEs (SGX, OP-TEE in ARM, Microsoft Azure) across platforms (the CCC's Enarx, SGX SDK,..) ...
1
vote
1answer
589 views

Is it secure to automatically unlock encrypted system drive using the TPM PCR values?

A simple way of automatically decrypting system drive at boot time: clevis luks bind -d /dev/yourdrive tpm2 '{"pcr_ids":"4,5"}' systemctl enable clevis-luks-askpass.path When I ...
3
votes
0answers
116 views

Using TPM to generate certificates associated with different users on the same device

I plan to use the TPM to generate CSR's backed by a private key stored on the TPM. The CSR's will then be signed by an external HSM. Since a certificate is tied to a particular private key, how do you ...
0
votes
0answers
199 views

Bitlocker TPM + PIN vs pre-boot DMA attack

In this link there are talks about pre-boot DMA attack: https://eclypsium.com/2020/01/30/direct-memory-access-attacks/ If the user would have a Bitlocker TPM + PIN enabled, would an attacker with a ...
1
vote
1answer
207 views

How can we use a symmetric key for signing data on TPM2.0?

I am trying to sign some data with a symmetric key AES128 on the TPM2. However, I get this error during the signing ERROR: Unknown key type, got: 0x25 ERROR: bad signature scheme for key type! ERROR: ...
2
votes
2answers
2k views

Can I safely disable and re-enable Secure Boot when Bitlocker is used in order to make a Forensic Image?

I am about to make a forensic image (using dc3dd from OSFClone) of two laptops and in this specific case I'd like to startup using an bootable USB stick with OSFClone and image the disk to an external ...
1
vote
1answer
128 views

Use of SoftHSM2 in commercial products

I came across SoftHSM2 from OpenDNSSec(BSD license) which is a drop-in replacement for HSM except that SoftHSM2 only lacks physical security. Also, being the fact that PKCS#11 is the standard ...
7
votes
2answers
2k views

TPM or OpenSSL for key generation?

I would like to know which method is more secured. I know that they can be combined, but I would like to understand why TPM or OpenSSL might be a more secure technique to generate (encryption, ...
1
vote
0answers
138 views

Better security for storing certificates in LUKS or softhsm?

What is the best place to store certificates and keys which are confidential and sensitive? As I understand LUKS is fine and kernel transparently handles encryption/decryption. Also, the LUKS volume ...
2
votes
1answer
98 views

How can I protect myself from intercepting messages sent to the server?

I want to collect certain data from my application using the driver and transfer it to the server to check its integrity. And I want to sign these packages using TPM to avoid forgery. However, a user ...
0
votes
1answer
210 views

How secure is Heads for detecting tampering or infection of firmware or boot sector? (Pureboot)

I'm thinking of getting a Librem laptop with Pureboot which uses Heads (with the Librem key) for tamper detection. But I've heard rumours that there are weaknesses or vulnerabilities so I wanted to ...
1
vote
0answers
109 views

Can I damage my hardware TPM by improperly treating it?

I read somewhere that TPMs are not hard to be rendered useless or broken by improper use of its API, considering I have complete user access to it via the command line. Is that true? Could you give an ...
6
votes
1answer
11k views

What really is the difference between firmware TPM and a discreet one and should it be trusted more?

What really is the difference between a physical TPM and any implementation of a fTPM? I get that both adhere to the same specification and in my mind should be the same thing, but then, I don't ...
1
vote
0answers
159 views

How to use TPM for key management [closed]

I have read about TPM that these are the secured ways of storing cryptographic keys. I want to know how can I use it. I have an application running on a PC which has TPM. This application has hard ...
2
votes
2answers
698 views

Installed TPM, how to use BitLocker without USB key?

I have a Windows 10 computer with 3 hard drives: Samsung SSD 850 EVO 1TB (SSD, system drive where Windows 10 is installed, not encrypted yet) First 3 TB HDD already protected by BitLocker Second 3 TB ...
2
votes
1answer
530 views

What are the dangers of a firmware malware in 2021 and is it possible?

I was reading a few articles online about how some firmware can be altered into malware and essentially infect a hardware equipment for its entire life time. Like almost all SSDs in the industry ...
3
votes
1answer
178 views

Can I secure the bootloader without a TPM?

I have a lot of PCs without a TPM installed. Buying TPMs for all of them is not an option, but I still want to do encryption on them. From what I've studied so far, the entire system/boot partition ...
1
vote
0answers
146 views

How is .NET Core isolated storage "secured" on various OS's?

I'm looking for a consolidated list of how and where isolated storage is managed on each operating system... (Windows, MacOS, Linux, (mobile?), ...) Does such a list exist? What considerations might ...

1
2 3 4 5