Questions tagged [tpm]

A Trusted Platform Module (TPM) is a secure coprocessor found in some x86-based computers that provides cryptographic operations and system integrity measurements.

Filter by
Sorted by
Tagged with
1
vote
1answer
75 views

Can I safely disable and re-enable Secure Boot when Bitlocker is used in order to make a Forensic Image?

I am about to make a forensic image (using dc3dd from OSFClone) of two laptops and in this specific case I'd like to startup using an bootable USB stick with OSFClone and image the disk to an external ...
1
vote
1answer
44 views

Use of SoftHSM2 in commercial products

I came across SoftHSM2 from OpenDNSSec(BSD license) which is a drop-in replacement for HSM except that SoftHSM2 only lacks physical security. Also, being the fact that PKCS#11 is the standard ...
7
votes
2answers
1k views

TPM or OpenSSL for key generation?

I would like to know which method is more secured. I know that they can be combined, but I would like to understand why TPM or OpenSSL might be a more secure technique to generate (encryption, ...
1
vote
0answers
37 views

Better security for storing certificates in LUKS or softhsm?

What is the best place to store certificates and keys which are confidential and sensitive? As I understand LUKS is fine and kernel transparently handles encryption/decryption. Also, the LUKS volume ...
2
votes
1answer
59 views

How can I protect myself from intercepting messages sent to the server?

I want to collect certain data from my application using the driver and transfer it to the server to check its integrity. And I want to sign these packages using TPM to avoid forgery. However, a user ...
0
votes
1answer
48 views

How secure is Heads for detecting tampering or infection of firmware or boot sector? (Pureboot)

I'm thinking of getting a Librem laptop with Pureboot which uses Heads (with the Librem key) for tamper detection. But I've heard rumours that there are weaknesses or vulnerabilities so I wanted to ...
1
vote
0answers
64 views

Can I damage my hardware TPM by improperly treating it?

I read somewhere that TPMs are not hard to be rendered useless or broken by improper use of its API, considering I have complete user access to it via the command line. Is that true? Could you give an ...
1
vote
1answer
74 views

What really is the difference between firmware TPM and a discreet one and should it be trusted more?

What really is the difference between a physical TPM and any implementation of a fTPM? I get that both adhere to the same specification and in my mind should be the same thing, but then, I don't ...
1
vote
0answers
50 views

How to use TPM for key management [closed]

I have read about TPM that these are the secured ways of storing cryptographic keys. I want to know how can I use it. I have an application running on a PC which has TPM. This application has hard ...
2
votes
1answer
84 views

Installed TPM, how to use BitLocker without USB key?

I have a Windows 10 computer with 3 hard drives: Samsung SSD 850 EVO 1TB (SSD, system drive where Windows 10 is installed, not encrypted yet) First 3 TB HDD already protected by BitLocker Second 3 TB ...
1
vote
1answer
167 views

What are the dangers of a firmware malware in 2021 and is it possible?

I was reading a few articles online about how some firmware can be altered into malware and essentially infect a hardware equipment for its entire life time. Like almost all SSDs in the industry ...
3
votes
1answer
80 views

Can I secure the bootloader without a TPM?

I have a lot of PCs without a TPM installed. Buying TPMs for all of them is not an option, but I still want to do encryption on them. From what I've studied so far, the entire system/boot partition ...
1
vote
0answers
56 views

How is .NET Core isolated storage “secured” on various OS's?

I'm looking for a consolidated list of how and where isolated storage is managed on each operating system... (Windows, MacOS, Linux, (mobile?), ...) Does such a list exist? What considerations might ...
0
votes
0answers
85 views

In relation to TPM specification, what are (e.g.) Apple's T2 or Google's Titan chips?

I understand that TPM is a specification and devices conforming to it are called Trusted Platform Modules and they play an important role in trusted computing (as is defined by the same people who ...
2
votes
0answers
68 views

Using a TPM as a hardware authentication device

My company is currently developing a product which consists of a fairly generic PC hardware platform and a software stack (the software stack is based on a Debian Buster Linux OS + some applications ...
2
votes
1answer
151 views

What does a TPM have in common with smart cards?

The title really says it all. I'm starting to dig a little bit into computer security and from what I've watched or from what I have read in books or articles there's always a mention of basic smart ...
0
votes
0answers
22 views

Does the TPM check the addition/removal of boot-entries

I have an issue that has been puzzling me tegarding the TPM checks on my machine, and I cannot find much documentation about the checks a TPM exactly performs. The issue is the following; I have a ...
1
vote
1answer
84 views

Does a TPM replace the default device's security, or add to it?

Does a TPM replace the default device's security, or add to it? I will try to re formulate it into 2 questions, just to explain what my question is, since I am not very good at English writing. If we ...
1
vote
0answers
87 views

Does (UEFI) secure boot provide security advantages over TPM measured boot?

Given how UEFI secure boot appears later than TPM, i had assumption that it provides advantages over TPM. As i read into each, it appears to me that the TPM measurements to each stage would provide ...
3
votes
1answer
899 views

What's the difference between the endorsement key and the attestation identity key within the TPM?

I'm trying to make notes about the TPM and what it does. More specifically I'm looking at the 3 RSA key pairs: the 'endorsement key', the 'storage root key' and the 'attestation identity key'. This is ...
2
votes
0answers
117 views

What are the prerequisites for cloning a Trusted Platform Module (TPM), and how does that affect security?

My company laptop recently needed a new mainboard as the old one was defective. The repair was carried out by the manufacturer, who sent a field engineer to my home. Since the laptop uses BitLocker ...
0
votes
0answers
32 views

Apple T2 chip endorsement key

Does Apple's T2 chip have an endorsement key (or equivalent mechanism) to prove that another T2 key can only be used inside the secure enclave? We are looking for something like what a TPM provides so ...
2
votes
1answer
108 views

Using TPM persisted RSA key in Windows and Linux

Our solution includes a Windows tool that creates/opens a persisted RSA key stored in the TPM and encrypts/decrypt data using it. This works flawlessly. Now we need to decrypt that data but from a ...
0
votes
0answers
69 views

TPM and MitM during boot phase

I have just started learning on TPM 2.0 and something is not clear. During a measured boot, we send hashes to TPM to be stored / extended into PCRs. How does the link between the code that is executed ...
0
votes
1answer
96 views

Who am I really trusting?

My trusted root certificates are below. As an exercise, I want to be sure that a MITM is not changing the list. So, can I somehow get this list signed? In my opinion, the list could be signed by my ...
1
vote
1answer
164 views

Why doesn't the PIN become part of the encryption key in bitlocker with TPM?

I have read here that if you choose TPM + PIN protection the PIN does not become part of the key, it is simply used by the TPM as an additional security measure. It doesn't make sense to me, it would ...
0
votes
1answer
171 views

What kind of “actions” can a TPM2 policy authorize?

I've been instructed to use the state of our system's TPM's PCR registers to prevent the system we're working on from booting if one of the PCR registers is different from what we expect. In service ...
2
votes
1answer
667 views

How secure is BitLocker without TPM?

My laptop doesn't have TPM. If I enable BL PIN and someone steals my laptop and remove the drive, will they be able to read it's content on another computer? How am I vulnerable without TPM?
1
vote
0answers
69 views

TPM & Windows BitLocker: how does it work and is it secure?

When starting a BitLocker-encrypted machine with a TPM and Windows 10 installed, you aren't prompted to enter a decryption key. The system relies on Windows lockscreen for authentication instead. My ...
2
votes
1answer
222 views

Has there ever been a known case of Bitlocker breach through lock screen?

Scenario: A Windows user with Bitlocker-encrypted OS drive uses Win+L shortcut to lock their computer, but leaves it powered on. At this point, their house is raided (by police, or thieves, or FBI, ...
1
vote
2answers
74 views

How do we know that input to TPMs actually comes from the measured code?

Suppose we're using secure boot and remote attestation to prove to a server what client software is talking to it. What stops an attacker from doing this: Start a legitimate copy of the client ...
0
votes
0answers
40 views

TPM2 Remote Attestation

I need to know how to seal data for example in platform A, according to some values of PCR, and them, send the seal data to a platformB, this platform get the data and do an unseal to get the ...
1
vote
1answer
46 views

TPM2 generate Key pair according to PCR values

I 'm finding a lot of information and i can't search the command. I need to execute a command, that create a key pair according to the PCR values, so in case of these pcr have not changed, always ...
1
vote
1answer
111 views

TPM Attestation and key exchange

I have the following problem: I have two platforms, one of them has a TPM. I need to transfer data between these two platforms, so I first determine an attestation, in order to confirm that the ...
0
votes
1answer
37 views

Does Hardware TPM have TAB/RM component?

Firstly I am not sure if this is the right place to ask this. If anyone has any idea of where this question belong please tell me. Recently I was reading about TPM and TSS(TPM Software Stack). The ...
5
votes
2answers
407 views

Is it possible to make a laptop useless to thieves?

I was robbed... That included my Linux notebook and my company's notebook. Both are encrypted. Mine is encrypted with LVM over LUKS, using a passphrase to unlock the hard drive once the kernel has ...
1
vote
1answer
92 views

Can a Trusted Platform Module be used as a Trojan Horse?

Does it matter where I buy my TPM from? What are the downsides of buying a $15TPM over Ebay? Can a TPM be a Trojan horse that compromises my security?
1
vote
0answers
53 views

Is anonymous remote attestation viable?

I'm currently reading about the TPM and remote attestation. Here's my current understanding of what is happening. To attest a PCR value to a remote party, the TPM signs the value with an attestation ...
1
vote
0answers
71 views

How can I create restricted signing key or attestation key and certify it in TPM 2.0?

I need to create an attestation key (AK) and use it to sign arbitrary data in TPM 2.0. The TCG Guidance documents, suggest that some TPMs may come pre-provisioned with an AK that is part of the ...
0
votes
0answers
43 views

Is it (easily) possible to deactivate a TPM in order to update the BIOS?

My assumption is that a BIOS update, while having a TPM activated, would render the computer unusable so that I could trash it unless I can revert the changes to the BIOS. 1) Is it possible to ...
0
votes
0answers
34 views

How does a TPM inform me that someone has tampered with the BIOS under Linux / Ubuntu?

I read guides on how to set up a TPM but none of them tells me how a TPM actually works in practice (under Linux/Ubuntu which I use). My understanding is that a TPM can inform me whether any of the ...
1
vote
0answers
97 views

“Something you have” on a multi-user device - what is the opinion regarding the NIST AAL3 definition?

The NIST AAL3 specification requires In order to authenticate at AAL3, claimants SHALL prove possession and control of two distinct authentication factors through secure authentication ...
1
vote
1answer
484 views

openssl: does -keyform engine enables accessing TPM persistent handles with any key arguments ? Even with third party plugin like CMP?

If I use the tpm2tss-engine coupled with openssl, can I substitute, optionally any file path to a private key by a TPM persisent handle ? Will it work with extensions, like CMP for OpenSSL, for ...
1
vote
0answers
85 views

Practicality of Direct Anonymous Attestation [closed]

DAA (Direct Anonymous Attestation) is not the only scheme to achieve anonymous attestation. In general, these schemes allow an entity to stay anonymous throughout the attestation process. The concern ...
2
votes
1answer
99 views

RAID + IEEE1667 + TPM + UEFI

Windows Server using a IEEE-1667 drive allows hardware based encryption on the fly. What are our options when using two disks with a RAID controller, in order to achieve redundancy and parity (T10-...
-1
votes
2answers
919 views

How can BitLocker be considered safer, if it doesn't asks for a key during boot?

I've been using VeraCrypt / TrueCrypt for years. Now, with a new computer (having Windows 10 Pro) I can consider BitLocker. But, either I am complete ignorant and don't see something awfully obvious ...
2
votes
0answers
43 views

Is it possible to securely transfer a symmetric key to a VM instance with the use of vTPM?

We have a physical Xeon host (bare metal - BM host) with a hardware TPM installed on it. The BM host's attestation status is established at through boot-time measurements captured and written to the ...
1
vote
0answers
582 views

Use TPM 2.0 to automatically decrypt the SD Card in Raspbian OS

I'm a college student trying to complete the first part of a rather large project, but I'm new to TPM, and Linux. What I'm trying to do is have TPM handle automatic decryption of the root ext4 ...
0
votes
2answers
650 views

Bitlocker/Filevault and VeraCrypt together?

I'm researching ways to make the most secure encryption for additional fixed drives to protect against unknown vulnerabilities, side channel attacks, etc. Basically, securing the data beyond just a ...
1
vote
1answer
446 views

BeagleBoneBlack, TPM and uBoot

I'm using BBB in my project. I need to prevent any changes to the software running on it. I've been reading about uBoot and TPM. But if I understand everything correctly, this can't be implemented ...