Potential impact of the Intel ME vulnerability

Re:Potential impact of the Intel ME vulnerability by upofadown on Monday November 27, 2017 @08:47PM (#15793557)

The interesting thing about whole disk encryption is that it is not really breakable if a reasonably long password/phrase is used. Using a TPM adds a huge attack surface for no practical reason. A large enough attack surface in this case that it is almost for sure going to be broken. The user only is going to be entering the password/phrase once per boot.

Things are different in the case of something like a phone. In that case you are pretty much forced to use some low entropy key that could otherwise be brute forced. Then a secure hardware device makes sense, particularly if the phone does not use the device for everything but the kitchen sink as in this case.

[ Parent | on HN ]

Re:Potential impact of the Intel ME vulnerability by mjg59 on Monday November 27, 2017 @08:51PM (#15793577)

There's a huge practical benefit - the user gains disk encryption without having to remember a secure passphrase. That's a big deal.

[ Parent | on HN ]

Re:Potential impact of the Intel ME vulnerability by wildmusings on Monday November 27, 2017 @09:06PM (#15793646)

Exactly and to elaborate, it means that the only secret a user needs to remember is a short PIN for OS-level authentication. The TPM's protection against modified boot and OS components make a brute force very difficult. Further, Windows will actually feed that PIN to the TPM for purposes of OS-level authentication, which leverages the TPM's enforcement of rate limits and lockouts in addition to OS-level implementations of those protections.

A nice improvement would be to use a PIN entered at boot for purposes of drive decryption and then automatically pass it through to the OS-level login.

[ Parent | on HN ]

Re:Potential impact of the Intel ME vulnerability by cm2187 on Tuesday November 28, 2017 @03:39AM (#15795441)

And for a server it enables to reboot autonomously while protecting you from someone pulling a hard drive from the array (think server colocation).

[ Parent | on HN ]

Re:Potential impact of the Intel ME vulnerability by brians on Tuesday November 28, 2017 @01:47AM (#15794990)

It sounds like your threat model doesn’t interactive hardware adversaries. Mine does, so worry about how they might capture my long pass phrase is a big concern.

Well, to whom do I tell my long passphrase? Right: my computer. Every morning. Is it running the same software as last night, no keyloggers, etc?

That’s what the TPM is for.

[ Parent | on HN ]