Hot answers tagged

116 votes

Can we tamper-proof a game that's sold along with the Windows machine it runs on?

We can analyze your setup by comparing it against a system known to be not tamper proof, the Sony PlayStation 3. OS control You have no control over the OS. Sony did write the OS themselves. Size ...
user avatar
  • 2,699
89 votes

Can we tamper-proof a game that's sold along with the Windows machine it runs on?

There are too many things that can be done at the OS level. That's the actual problem. There are numerous ways to launch processes and/or explore the system. One important aspect is that it looks like ...
user avatar
  • 8,749
39 votes

Can we tamper-proof a game that's sold along with the Windows machine it runs on?

It sounds like you're creating an arcade machine. In that case, learn from the companies who actually make and sell arcade machines, and Use Windows Embedded instead of the desktop version. Using TPM ...
user avatar
37 votes
Accepted

What are the differences between TPM and HSM?

Trusted Platform Modules A Trusted Platform Module (TPM) is a hardware chip on the computer’s motherboard that stores cryptographic keys used for encryption. Many laptop computers include a TPM,...
user avatar
  • 1,040
30 votes

Can we tamper-proof a game that's sold along with the Windows machine it runs on?

This is not secure. The hardware is under the control of the user, so they can always find a way. I'm assuming that TPM is meant to prevent the user from starting another OS (like Ubuntu) from CD, ...
user avatar
  • 5,486
29 votes

What are the differences between TPM and HSM?

Sorry, but I think there are some gaps in this conversation: TPMs can't be added later : False. Many modern motherboards include a header to which a TPM can be added after the fact. Visit Amazon ...
user avatar
29 votes
Accepted

Do a TPM's benefits outweigh the risks?

It depends on your threat model. A TPM has multiple purposes, but the most common purpose is measured boot. That is, a TPM will verify the integrity of the BIOS, option ROMs, bootloader, and other ...
user avatar
  • 64.1k
27 votes

Can we tamper-proof a game that's sold along with the Windows machine it runs on?

Some ideas of attack against that: Windows normally comes with a Repair mode. It may be more or less easy to activate it (ref., but if it is possible the user can make the computer start in command ...
user avatar
24 votes
Accepted

TPM or OpenSSL for key generation?

The difference between using some hardware backed key store (i.e. TPM, HSM, smartcard ...) and a "pure software" solution like openssl genrsa is not so much about the security of the key ...
user avatar
21 votes
Accepted

Difference between TPM, TEE and SE

First let's layout the different definitions: TPM is a piece of Hardware specifically created to do crypto calculation with. It is physically isolated from the rest of the processing system and is ...
user avatar
  • 8,209
19 votes

Can we tamper-proof a game that's sold along with the Windows machine it runs on?

Only one attack is enough to prove that it's insecure, right? Press the Shift key 5 times. A dialog will pop up, asking if you want to activate some feature for disabled persons. On that dialog, ...
user avatar
16 votes
Accepted

What are the functional similarities and differences between TPM and SGX in trusted computing?

Well first off, SGX is not a crypto chip. It is a feature built into Intel chipsets themselves, whereas the TPM is often a discrete chip positioned on the LPC bus, though sometimes it can be emulated ...
user avatar
  • 64.1k
14 votes
Accepted

What happens when a TPM chip breaks or fails?

The purpose of a TPM module is to ensure that there is absolutely no way to obtain the keys stored on it. Whether or not it actually fulfills that purpose is a topic for another question. For now let'...
user avatar
  • 48.8k
14 votes

What's the difference between the endorsement key and the attestation identity key within the TPM?

Unfortunately there is not a single source of truth about attestation. I'll try to make it as clear as possible and cite when necessary. TL;DR: The Endorsement Key is used to prove that you are ...
user avatar
  • 491
11 votes
Accepted

How does full memory encryption in newer processes protect against DMA attacks?

How does memory encryption impact DMA attacks? Full-memory encryption is not designed to protect against DMA attacks. That is what an IOMMU is for. The IOMMU is configured using a type of ACPI table ...
user avatar
  • 64.1k
10 votes
Accepted

Secure Boot on Microsoft Surface Pro 3 (or modern PCs)?

Boot Process Secure Boot There are quite a few steps to booting Windows 8. Now secure boot in general means that the boot loader is only run if its integrity can be checked. In this case, if ...
user avatar
  • 12.3k
9 votes
Accepted

TPM: signing key or Attestation Identity Key?

AIKs are only allowed to perform two signature-based operations: TPM_Quote, which generates a signed statement of the state of the PCRs using an AIK; this is the operation used in remote attestation. ...
user avatar
9 votes
Accepted

Usage of Android Keystore

Let's take a look at the Android Developer docs "Android keystore system". We'll need to break this down depending on how you use the KeyStore object. If you're using the Android KeyStore KeyStore....
user avatar
8 votes

What does CRTM refer to?

CRTM is saved in the Platform Configuration Registers (PCR), register 0 to be more precise (PCR-0). CRTM is (physically) embedded into chip silicon and provided by the BIOS, but is a logical part of ...
user avatar
  • 8,749
8 votes

What happens when a TPM chip breaks or fails?

If the TPM 'breaks' or becomes otherwise inaccessible, all cryptography dependent on keys stored by the TPM also breaks. This is the most concise and inclusive way I could think to put it. I say '...
user avatar
7 votes

How does the TPM perform integrity measurements on a system?

The most direct answer to your question is that the TPM doesn't do the measurements. The measurements and PCR values are completely proprietary to the platform in which the TPM is installed. The ...
user avatar
7 votes

Difference between TPM, TEE and SE

A little more on the functional aspects: TPM is fixed, well-specified functionality by an ISO and TCG standard. You can‘t just add or change this. Usually it‘s a discrete security chip connected ...
user avatar
6 votes

TPM 2.0 PKCS#11 on Windows and Linux

- It's a bit old question, but I managed to found a solution that worked for me. There's available on Github a module that provides PKCS#11 backend for TPM 2.0 chips. Usage: Create TPM Key Create ...
user avatar
  • 552
6 votes

Can we tamper-proof a game that's sold along with the Windows machine it runs on?

As others have said, this cannot be considered secure. You can however remove the 'low hanging fruit', both to reduce the chances of your software being stolen and to ensure your users experience is ...
user avatar
  • 161
6 votes
Accepted

What really is the difference between firmware TPM and a discreet one and should it be trusted more?

It is very hard to quantify security and justify trust. Before you read on: think about what you want to protect against whom. Make a risk analysis. I have heard mainly two justifications why physical ...
user avatar
  • 491
6 votes
Accepted

Is it possible to use HKDF in the TPM?

If it isn't in the spec it isn't in there. The question is if you need it if e.g. the NIST SP 800-108 KDF in counter mode is present. That's a fine KDF even if it lacks explicit extract / expand steps ...
user avatar
5 votes
Accepted

LUKS TPM disk encryption attacks

The TPM is used to seal the LUKS secret and nothing else. Once decrypted by the TPM (i.e. the proper environment has been loaded) the secret is stored in RAM hence it can be captured by coldboot ...
user avatar
  • 1,413
5 votes

How are TPMs provisioned for Intel Trusted Execution Environment (TXT)?

The Intel TXT is a complex system designed to provide a hardware layer of security that can prevent software layer changes from resulting in increased access for attackers. Through use of stored ...
user avatar
5 votes

Is it possible to make a laptop useless to thieves?

First of all, my condolences for your loss! Hope you're alright. If I understood correctly, your general concern is how to totally prevent further stolen device usage (and/or sale) by a criminal. In ...
user avatar
  • 3,385

Only top scored, non community-wiki answers of a minimum length are eligible