Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [trusted-computing]

Trusted Platform Module (TPM) and other protocols and components of trust in a computer or computer network

Filter by
Sorted by
Tagged with
1 vote
0 answers
73 views

How and why can a TPM be used for disk encryption or DRM?

I don't know much about TPMs, and I admittedly don't know as much about cryptography as I'd like to, though I am quite familiar with basic concepts. For the past two hours I've been attempting to ...
Nullcaller's user avatar
1 vote
1 answer
180 views

Why the TPM PCRs does not consider a UEFI settings change? If someone resets CMOS, it's undetected

In my laptop I've set up a bios password when I power on the laptop, and once I enter it the laptop starts my linux distro and decrypts the disk without asking any other password. To do this I've set ...
Allexj's user avatar
  • 137
2 votes
0 answers
345 views

How to wrap/unwrap with TPM2 endorsement key

I have a remote client A which wants to communicate securely with a server B having a discrete TPM. My understanding is that each TPM normally come with a endorsement key from manufacture like ...
feplooptest's user avatar
1 vote
0 answers
283 views

Is it possible to see the pubkeys that pair with private keys inside the TPM in Windows?

Is it possible to inspect data (pubkeys, domain names used for webauthn, not private keys) related to private keys stored in the TPM on Windows? I legally own the hardware and have maximum ...
mikemaccana's user avatar
3 votes
1 answer
1k views

How can an application, using Apple's Secure Enclave on macOS or TPM on Windows, protect itself from other applications accessing its private keys?

I'm interested in using Apple's Secure Enclave on macOS or TPM on Windows to protect cryptographic keys used by an application from being accessed by other applications running with the same or higher ...
Pathong's user avatar
  • 56
2 votes
1 answer
329 views

Are TPM PCRs volatile, non-volatile, or both?

Do PCRs (Platform Configuration Registers) on TPMs (Trusted Platform Modules) retain their data on reboot? I'm trying to find out if all (or some) of the PCRs on a TPM are volatile (will loose their ...
Michael Altfield's user avatar
1 vote
0 answers
133 views

Is there any use case of DAA (Direct Anonymous Attestation) in TPM?

I want to know the use cases of DAA (Direct Anonymous Attestation) in the real world.
user97821's user avatar
1 vote
1 answer
468 views

How to distribute Android mobile app functionality between OS, Trusted Execution Environment (TEE) and Secure Element (SE)?

There are different scenarios when it's about secure computation/storage on mobile devices, e.g., "REE only", "REE + TEE", or "REE + SE" or "REE + TEE + SE". ...
Shakalakah's user avatar
4 votes
1 answer
1k views

Practicality of outsourcing password hashing using enclaves

I've been pondering some potential cybersecurity applications for enclaves. One of them being the problem of password hashing. Some clients have enclave support, meaning part of their CPU can securely ...
Expectator's user avatar
3 votes
1 answer
13k views

Understanding TPM PCRs, PCR banks, indexes and their relations

I'm reading about TPM, and I'm currently thinking how to visualize their relationships. Basically, reading from https://link.springer.com/chapter/10.1007/978-1-4302-6584-9_12 (and the TPM documents) I ...
Veksi's user avatar
  • 259
1 vote
0 answers
307 views

Hardware roots of trust nowadays

I find that names and terms used in relation to Trusted (Trustworthy, Confidential,..) Computing are highly interchanged and thus creating confusion for laymen as am I. Trusted Computing has been ...
T. Maxx's user avatar
  • 145
0 votes
0 answers
384 views

What is the difference betwen a Trusted Computing Base and a Root of Trust?

What is the difference betwen a Trusted Computing Base (TCB) and a Root of Trust (RoT)? Can both terms be used interchangeably? A TCB is defined by the NIST as follows: Totality of protection ...
DurandA's user avatar
  • 127
2 votes
0 answers
279 views

Using TPM to generate certificates associated with different users on the same device

I plan to use the TPM to generate CSR's backed by a private key stored on the TPM. The CSR's will then be signed by an external HSM. Since a certificate is tied to a particular private key, how do you ...
Dr. Lecter's user avatar
1 vote
0 answers
165 views

Can I damage my hardware TPM by improperly treating it?

I read somewhere that TPMs are not hard to be rendered useless or broken by improper use of its API, considering I have complete user access to it via the command line. Is that true? Could you give an ...
T. Maxx's user avatar
  • 145
9 votes
3 answers
21k views

What really is the difference between firmware TPM and a discrete one and should it be trusted more?

What really is the difference between a physical TPM and any implementation of a fTPM? I get that both adhere to the same specification and in my mind should be the same thing, but then, I don't ...
T. Maxx's user avatar
  • 145
2 votes
1 answer
182 views

Root of Trust - The general Mechanism of how RoT Authenticates higher levels of software

I've been reading many research articles about RoT - Root of Trust - for establishing a chained root of trust going up from BIOS to the Kernel. However, most of the article go briefly on how RoT works ...
Omar Jarkas's user avatar
0 votes
1 answer
141 views

How to ensure integrity of program execution on foreign(someone else's) computer?

I want to run my computer program(or code) on someone else's computer(with permission from the owner of the computer) and get the results back. How can I make sure the owner is running my program only,...
Libertarian's user avatar
1 vote
0 answers
356 views

In relation to TPM specification, what are (e.g.) Apple's T2 or Google's Titan chips?

I understand that TPM is a specification and devices conforming to it are called Trusted Platform Modules and they play an important role in trusted computing (as is defined by the same people who ...
T. Maxx's user avatar
  • 145
2 votes
1 answer
1k views

What does a TPM have in common with smart cards?

The title really says it all. I'm starting to dig a little bit into computer security and from what I've watched or from what I have read in books or articles there's always a mention of basic smart ...
T. Maxx's user avatar
  • 145
10 votes
1 answer
10k views

What's the difference between the endorsement key and the attestation identity key within the TPM?

I'm trying to make notes about the TPM and what it does. More specifically I'm looking at the 3 RSA key pairs: the 'endorsement key', the 'storage root key' and the 'attestation identity key'. This is ...
BetaInProgress's user avatar
2 votes
1 answer
632 views

In an Arm TrustZone based Trusted Application (TA), how can a remote party tie an output to a particular TA?

I've been looking at the following figure which shows, with Arm TrustZone architecture, resources of a system can be divided into a Rich Execution Environment (REE) and a Trusted Execution Environment ...
SpiderRico's user avatar
4 votes
1 answer
398 views

What Trusted Execution Environment (TEE) solutions exist for mobile devices?

A trusted execution environment (TEE) provides a way for one to deploy tamper-proof programs on a device. The most prominent example of TEEs seem to be Intel SGX for PCs. What I wonder is, if there ...
SpiderRico's user avatar
1 vote
0 answers
256 views

How can I create restricted signing key or attestation key and certify it in TPM 2.0?

I need to create an attestation key (AK) and use it to sign arbitrary data in TPM 2.0. The TCG Guidance documents, suggest that some TPMs may come pre-provisioned with an AK that is part of the ...
mohamed's user avatar
  • 11
1 vote
0 answers
183 views

"Trusted memory" What does it mean?

It is often cited "to load from untrusted memory to a trusted system memory" when describing the secure boot process. I wonder, when can we consider a memory as "trusted"?
Lavender's user avatar
  • 259
0 votes
0 answers
279 views

Bypassing Secure Boot in System on Chip

To bypass a secure boot for System on Chip (SoC), some attacks target the phase of copying the bootloader from where it is stored to the main memory. Instead, a malicious code will be copied to the ...
Lavender's user avatar
  • 259
1 vote
1 answer
3k views

Why authenticated boot not Secure boot?

Context: Secure boot is one of the important elements of Trusted Computing in computer system. One variety of the Secure boot is authenticated boot. While secure boot prevent the boot of a non trusted ...
Lavender's user avatar
  • 259
7 votes
3 answers
2k views

Is a cryptographically signing camera possible?

What kind of digital / cryptographic signing would make it possible to create a camera that cryptographically signs the photos it takes so that the images can be verified to have been taken with that ...
Simon Woodside's user avatar
1 vote
1 answer
221 views

Using keys inside a secure enclave on a non trusted hardware and OS

Are secure enclaves like intel SGX protected from memory leaks? What if a non trusted privileged user dumps all the physical RAM memory. Is it possible to extract the keys in this way?
prosaad's user avatar
  • 13
10 votes
2 answers
8k views

What are the differences between HSM and SE?

What are the differences between a Hardware Security Module (HSM) and a Secure Element (SE)? Can both terms be used interchangeably? I came across various related question (TPM vs. HSM and TPM vs. SE)...
DurandA's user avatar
  • 127
3 votes
1 answer
1k views

Where to store signing key in TPM

I'm using TPM 2.0 to do a remote attestation for a computer. In order to do that you have to generate a signing key from a primary key. This generate a public key and an encrypted private key. As per ...
Marwen Jadla's user avatar
3 votes
1 answer
1k views

Extra features required for TrustZone to provide main security features

The paper Trustworthy Execution on Mobile Devices: What Security Properties Can My Mobile Platform Give Me? describes 5 desired security features for mobile devices: Isolated Execution Secure Storage ...
Oren Milman's user avatar
0 votes
1 answer
2k views

Asymmetric/Symmetric Encryption of a TPM key hierarchy

I know that keys in a TPM key hierarchy are encrypted with their parent keys. But I read that those parent keys (for instance an asymmetric SRK) need to have some symmetric secret for said encryption. ...
Sushiman's user avatar
2 votes
1 answer
2k views

Can I prove the relation between AIK and EK without asking to the TPM 2.0?

The Endorsement Key (EK), the Public part, is available directly on the TPM chip, I know that you can generate an AIK key and then sign with that key, the hash must be generated by the TPM. The idea ...
jbarbosa's user avatar
1 vote
1 answer
961 views

Symmetric Keys for a TPM [duplicate]

I am currently researching the capabilities of TPM in creating and storing different kinds of cryptographic keys. I know that a TPM can create and store keys for asymmetric algorithms like RSA or ...
Sushiman's user avatar
2 votes
1 answer
2k views

With TPM how are the initial PCR values seeded with 'good' values?

I am trying to learn more about trusted boot / trusted platform modules and I understand about Platform Configuration Register (PCR) values being a measurement of a 'good' configuration signed by a ...
decodebytes's user avatar
3 votes
0 answers
501 views

TPM - Device Softwareupdate - What happens to my sealed key?

Imagine having a device that has a TPM (Trusted Platform Module). This TPM is used to store keys. Some of these keys are sealed to PCR constraints, meaning that they can only be opened if the PCRs ...
TrinityTonic's user avatar
2 votes
0 answers
1k views

Use TPM 1.2 to store the private key of a certificate

Let's say I have an application that requires certificates (HTTPS, MQTTs, etc.) due to the use of TLS. I'm planning to build my own tier-1 PKI hierarchy with my own company CA signing device ...
TrinityTonic's user avatar
4 votes
0 answers
3k views

What is Silent Lake?

The Wikipédia's TEE entry mentions a hardware technology called Silent Lake that can support TEE implementations: The following embedded hardware technologies can be used to support TEE ...
Daniel's user avatar
  • 677
1 vote
0 answers
117 views

TPM and trust in cloud provider [closed]

I'm kinda unclear and confused ,i'm searching on the subject of trusted module platform and i can resume the main tpm's functions are: authentication functions, integrity measurement functions and ...
user avatar
0 votes
0 answers
329 views

TPM and the secret key

It's written that the TPM never allows these private keys to be exported outside the chip. This means that the only way to sign something with one of those keys is to use the computer to send a ...
user avatar
1 vote
1 answer
654 views

TPM with the three main groups of functions

I’m a little unclear on this (marked strong): "The public key authentication functions provide for on-chip key pair generation using a hardware random number generator, along with public key ...
user avatar
0 votes
2 answers
1k views

How does the TPM provide security for the cloud?

The primary scope of TPM is to assure the integrity of a platform. In this context, "integrity" means "behave as intended". ~Wiki I'm learning more about how the TPM performs integrity covering ...
user avatar
1 vote
1 answer
539 views

Verifying that the CRTM is read-only for the purpose of trusted computing

When using a TPM to provide integrity measurements for a system via SRTM, the trusted computing base is reduced to only the TPM and CRTM. The CRTM is a component of the BIOS (specifically the ...
forest's user avatar
  • 66.8k
2 votes
1 answer
209 views

Distinguishing features of TPM from software solutions

It's said that TPM is proposed to address issues that software alone cannot. To my understanding, this means TPM cannot be simulated using software. For example, as far as I know, TPM comes with a ...
Lingxi's user avatar
  • 121
1 vote
1 answer
480 views

TCG OPAL 2.0 Specification on technical Implementation?

Where can one find more technical information on the TCG OPAL 2.0 standard regarding how exactly the crypto has to been implemented in self encrypting drives? I couldn't find OPAL 2.0 implementation ...
user3200534's user avatar
17 votes
1 answer
9k views

What are the functional similarities and differences between TPM and SGX in trusted computing?

I know about the TPM (Trusted Platform Module). In recent years, more researchers start to develop on Intel SGX, which I do not have any experience with. They are both crypto chips, but what are ...
TJCLK's user avatar
  • 838
1 vote
1 answer
438 views

Understanding differences between kernel-based TCB and micro-kernel TCB

Recently I've been learning the concept of trusted computing base, and I've seen 2 types of TCB: Kernel-based TCB Micro-kernel TCB Where, from my understanding, the main difference is that in the ...
sel's user avatar
  • 433
2 votes
1 answer
1k views

Preventing new NVRAM areas from being defined in a TPM

Is there anyway to prevent new NVRAM areas from being defined on a TPM until the next reboot (similar to power-cycle types of protection)? The reason I ask is because firmware could check for NVRAM ...
Melab's user avatar
  • 247
2 votes
1 answer
250 views

what make a TEE secure?

A TEE implementation such developed in ARM trustzone OS is a carved out partition isolated from the main OS. What makes such a TEE secure? Is it the fact that the TEE is accessible only through a ...
Vakul Garg's user avatar
2 votes
2 answers
224 views

Is ransomware that threatens with publication and verifiably deletes upon payment possible?

Inspired by the article The future of Ransomware and its description of possible ransomware with verifiable key delivery, I wonder if the idea can be taken further into ransomware that credibly ...
Sami Liedes's user avatar