Re:British right to repair law excludes smartphones and comp...
by als0 on Thursday July 01, 2021 @05:32PM
(#27705143)
TPM keys are protected by policies. A policy can be based on the system state (hashes), a password, or both. There are also complex policies using the Extended Authorization feature. If you don't care about platform state or configuration, then you can just set a key policy with just a password. The TPM will lock you out if you make too many incorrect guesses.
You can in fact put passwords on most TPM internal objects. See this example https://github.com/tpm2-software/tpm2-tools/blob/master/man/...
The only check the TPM does when deciding whether to allow the key in one of its registers to be used is whether the stack is in a particular configuration. The TPM doesn't (and in fact can't) directly require passwords (since it has no direct line of communication to the user). However, the BIOS, bootloader, kernel, etc... can all be configured to mix user-provided information like a password into the hash they push into the TPM.