Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Join us in building a kind, collaborative learning community via our updated Code of Conduct.

A Trusted Platform Module (TPM) is a secure coprocessor found in some x86-based computers that provides cryptographic operations and system integrity measurements.

1
vote
1answer
74 views

Is a TPM which boots a full-disk-encrypted computer to login secure?

Currently the laptops in use are encrypted using Pre-Boot-Authentication, so the entire disk is encrypted. A user has to enter a password before booting the operating system. A new concept suggests ...
2
votes
1answer
103 views

For a “normal” computer user, does it make a difference to have a good entropy source?

Let's take, for example, Linux. From my understanding, there are different sources and different ways that can be used to gather entropy (RNG daemon, Intel rrandr, TPM, etc). Some produce entropy that ...
0
votes
0answers
71 views

How common are computers with a TPM

When writing software, is it worth targeting a TPM for increased security? That boils down to: how common are normal business desktop and laptop computers with a TPM (not servers, not so interested ...
2
votes
0answers
37 views

TPM - Device Softwareupdate - What happens to my sealed key?

Imagine having a device that has a TPM (Trusted Platform Module). This TPM is used to store keys. Some of these keys are sealed to PCR constraints, meaning that they can only be opened if the PCRs ...
6
votes
3answers
182 views

How does Bitlocker + TPM prevent me seeing the HDD contents with another OS?

I've googled the heck out of this, and have read multiple related questions on this site, but I'm still missing a crucial piece of the puzzle. I have a (work) laptop with Win10 Pro which is encrypted ...
0
votes
0answers
33 views

Can Yubikey complement a TPM chip?

Does the functionality of an external hardware key overlaps 100% with the one provided by an embedded security chip on a laptop? Or can they complement each other? Although I assume an external key ...
0
votes
1answer
37 views

What is the safest way to use Bitlocker with TPM?

I started using bitlocker yesterday and I have a TPM2.0 in my laptop. I enabled the option to enter a pin when starting and I enabled the option to use AES256 before encrypting. I don't really ...
2
votes
0answers
50 views

Use TPM 1.2 to store the private key of a certificate

Let's say I have an application that requires certificates (HTTPS, MQTTs, etc.) due to the use of TLS. I'm planning to build my own tier-1 PKI hierarchy with my own company CA signing device ...
3
votes
1answer
94 views

How does full memory encryption in newer processes protect against DMA attacks?

Upcoming Intel CPUs have TME, current AMD processors have SME. These are full-memory encryption techniques to protect against physical attacks such as cold boot attacks. Both support encrypting the ...
1
vote
0answers
32 views

Are Authentication and Attestation two different process?

I'm a little bit unclear reading this from an article A TPM can also be used to store platform measurements that help ensure that the platform remains trustworthy. Authentication (ensuring ...
1
vote
1answer
43 views

How can a Trusted Platform Module “enhance network security”?

I've recently bought a motherboard, which has support for a Trusted Platform Module. On the topic, the manual states the following: This connector supports Trusted Platform Module (TPM) system, ...
5
votes
2answers
291 views

Does a TPM's benefits outweigh the risks?

Is TPM really worth it? According to Wikipedia it: Provides a generator of random numbers (that's okay) Facilities for the secure generation of cryptographic keys for limited uses (that's okay too I ...
1
vote
0answers
29 views

TPM and trust in cloud provider [closed]

I'm kinda unclear and confused ,i'm searching on the subject of trusted module platform and i can resume the main tpm's functions are: authentication functions, integrity measurement functions and ...
1
vote
0answers
53 views

TPM and the secret key

It's written that the TPM never allows these private keys to be exported outside the chip. This means that the only way to sign something with one of those keys is to use the computer to send a ...
1
vote
1answer
43 views

TPM with the three main groups of functions

I’m a little unclear on this (marked strong): "The public key authentication functions provide for on-chip key pair generation using a hardware random number generator, along with public key ...
5
votes
1answer
144 views

What use does a TPM have for accurate timekeeping?

I stumbled across this image and something immediately stood out to me. This is a photograph of a discrete TPM card. That silver cylinder on the left is a crystal oscillator, used to tell time with ...
0
votes
1answer
63 views

How does the TPM provide security for the cloud?

The primary scope of TPM is to assure the integrity of a platform. In this context, "integrity" means "behave as intended". ~Wiki I'm learning more about how the TPM performs integrity covering ...
6
votes
1answer
92 views

How does ROCA affect Windows secure boot?

I've been doing some research on the Infineon vulnerability known as ROCA over the last few days. As I understand it, the vulnerability is present when a TPM running vulnerable firmware generates an ...
0
votes
0answers
11 views

Secure boot to the OS flash drives/CD for bootloader signature verification and TPM/UFEI signing

I have been learning about securing the OS and don't understand how to do so, how secure it is and if it can verify the integrity of a system that could have possibly been compromised (ruling out the ...
1
vote
0answers
43 views

Verifying that the CRTM is read-only for the purpose of trusted computing

When using a TPM to provide integrity measurements for a system via SRTM, the trusted computing base is reduced to only the TPM and CRTM. The CRTM is a component of the BIOS which executes first and ...
2
votes
1answer
62 views

Distinguishing features of TPM from software solutions

It's said that TPM is proposed to address issues that software alone cannot. To my understanding, this means TPM cannot be simulated using software. For example, as far as I know, TPM comes with a ...
3
votes
2answers
202 views

What are BitLocker requirements against computer theft?

I'm using Windows 10 Pro edition and took the following actions: I've set up Bitlocker on both disks using the TPM (2.0) to boot the computer. I've also set a Windows password and I have no guest ...
1
vote
1answer
123 views

Hypothetical: if I wanted to swap my corp laptop for an exact replacement? [closed]

This is a thought problem. Not sure if appropriate for Info Sec or if better suited elsewhere, so I will respect the mod's decisions as far as remediation or removal. I love my corporate laptop. It's ...
5
votes
4answers
607 views

Usage of Android Keystore

I'm using the Android Keystore to store an asymmetric cryptographic (to decrypt a file containing an asymmetric key). I did that because I want to encrypt a large set of data and an asymmetric isn't ...
0
votes
0answers
65 views

How to sign bootloader?

I am looking for a way to sign my Ubuntu bootloader. I also have a TPM2 chip and an ability to do secureboot. Any suggestions?
3
votes
0answers
91 views

securing Ubuntu bootloader using TPM

I am currently working with Ubuntu 16.04 , with an Intel CPU that supports TPM2 module. I am trying to harden my boot-loader, i tried using trustedgrub2 fork that supports TPM2 , i understand that ...
0
votes
1answer
292 views

How are Bitlocker FDE keys stored in the TPM?

If you are using Windows 10 Pro Bitlocker FDE with a TPM and enhanced PIN (= passphrase): How do the keys in the TPM get stored? Are they stored as plaintext or hashvalue or 'again' encrypted?
3
votes
3answers
135 views

Can TPM be used in the same way as TrustZone area?

Can I program the TPM chip to execute a piece of code securely just like executing code in the TrustZone area? In particular, the application will be running in the normal world, but parts of it ...
1
vote
0answers
35 views

Extracting public key created by an UWP app in KeyCredentialManager

I know of an app that is using https://docs.microsoft.com/en-us/uwp/api/windows.security.credentials.keycredentialmanager to generate a key pair (supposedly stored in a TPM), and sequentially uses the ...
1
vote
1answer
421 views

How secure is bitlocker with a pin when whole machine is stolen?

I assume if I use Bitlocker on Windows 10 on a laptop with a TPM chip without a password, then if the laptop gets stolen, then the attacker can simply turn the machine on and then he gets to the ...
2
votes
1answer
163 views

Does a bitlocker pin become part of the key?

I recently added a pin to my bitlocker encryption and this seemed to be pretty much instant. In what way is this pin an actual part of the key that is needed to decrypt the hard drive? Or is it used ...
2
votes
0answers
141 views

Storing Wireless auth certs in a TPM

Within my organisation we're being asked to provide a secure but seamless wireless experience e.g. user logs on to Windows device and are connected automatically to corporate network via wireless. ...
6
votes
1answer
718 views

What are the functional similarity and difference between TPM and SGX in trust computing?

I have the knowledge of TPM (Trusted Platform Module). In recent years, more researchers start to develop on Intel SGX, which I do not have any experience. They are both crypto chips, but what are ...
1
vote
1answer
112 views

Is there a risk from anyone having access to a TPM chip before you install it?

I intend to add a TPM chip to my computer’s motherboard to enable Bitlocker encryption for Windows 10. I purchased the chip online, and I’m curious if there would theoretically be any security risk ...
3
votes
1answer
472 views

Using the TPM module to measure boot process and remote attestation

I have a question about Remote Attestation and measured boot with a TPM-Module. The illustration shows my project schematically. A TPM module will be used to measure the boot process and validate ...
1
vote
0answers
112 views

ROCA attack on TPM - public key extraction

I was reading about the ROCA attack, and how a lot of software is vulnerable. Apparently Bitlocker from Microsoft is also vulnerable, because it protects its keys with SRK of (ROCA vulnerable) TPM. ...
5
votes
0answers
118 views

Security of TPM 1.2 for providing tamper-evidence against firmware modification

I would like to use a TPM for providing tamper-evidence to my workstation, using SRTM (Static Root-of-Trust for Measurement). Currently, I plan to have the TPM seal a one-time value which only I know, ...
40
votes
7answers
21k views

Can we tamper-proof a game that's sold along with the Windows machine it runs on?

We want to protect a game that is basically sold with the computer containing it. The security is done this way: The HDD is encrypted using hardware TPM 1.2, which holds a unique key to decrypt the ...
0
votes
1answer
77 views

How can I detect a MITM when the communication partner is in on it?

I was thinking about a host computer having a hardware TPM (Trusted Platform Module), with which I can get trustworthy information about the platform (first and foremost, that I am not in a virtual ...
2
votes
1answer
229 views

Is a TPM module insecure if not soldered to the board?

I am looking into Bitlocker for my headless Microserver N54l with windows server 2016 on it. I saw that the n54l has no TPM module, but I can buy one and plug it to the board. I am interested in it ...
0
votes
2answers
686 views

Hardware / firmware backdoors : TPM as a security risk - How to turn it into security advantage?

--- Question: What are the exact risks of using TPM 2.0 or owning this integrated chip? In what circumstances? What are the solutions to minimize risks? Details: My primary goal was to try to find ...
3
votes
1answer
600 views

Is it possible to extract secrets from a TPM without knowing the PIN?

I understand the general operation of a TPM, and in particular the interest of using a pre-boot PIN: if someone gets access to the machine (turned off), turning on the computer will not be enough to ...
0
votes
1answer
411 views

How Does The TPM Work With The CPU To Decrypt Data

Okay, from what I've been reading, At startup, the BIOS performs an integrity check and produces a hash value to set in the PCRs of the TPM (aka Core Root of Trust Module), and when all of the needed ...
2
votes
1answer
191 views

Preventing new NVRAM areas from being defined in a TPM

Is there anyway to prevent new NVRAM areas from being defined on a TPM until the next reboot (similar to power-cycle types of protection)? The reason I ask is because firmware could check for NVRAM ...
2
votes
0answers
184 views

TPM ownership, what is the low level process?

Ok, starting with some ground concepts, just incase I'm mistaken: Ownership of the TPM simply means to have the owner password. Taking ownership means to clear the tpm and to initialize the owner ...
2
votes
1answer
63 views

How are PCRs Checked and are external TPMs vulnerable to hardware attack

Are boot measurements checked against PCRs by the TPM, or is the PCR is reported and the measuring software does the check? Since the PCR validation enables the release of some secrets in the TPM, ...
1
vote
1answer
315 views

When to Extend PCR [closed]

The computational meaning behind extending the PCR it is easily found and clearly explained. Simply, it is extending the hash. It fact it's so simple that I think everyone forgets to say why it's ...
1
vote
1answer
203 views

TPM nvLocked flag

What does nvLocked control in a TPM? I've read it makes makes NVRAM access permissions be enforced, but I'd like examples. It is also referred to as permanent, but the documentation is ambiguous. ...
0
votes
1answer
3k views

How to configure TPM lockout in Bitlocker when using a PIN

I have Windows 10 (1607) and use Bitlocker with Pin protection. It is a TPM 2.0 chip. I got completely locked out of my a machine. It kept saying "Too many PIN attempts" at the Pre-Boot stage. I ...
1
vote
0answers
296 views

Does any DRM system work within a Virtual Machine? [closed]

I'm running a few quick tests to see if any DRM system works on a VM. Notably, most DRM systems (haven't found one yet), don't work on a virtual device: iPhone Simulator on OSX (FairPlay) Windows ...