Re:Home Made TPM2.0 Module
by daneel_w on Saturday May 07, 2022 @06:50AM
(#31293526)
Related: a lot of AMD CPUs these days come with "fTPM", which is AMD's built-in TPM solution, voiding the need for an external module. Intel has something similar that I forgot the name of, though I don't know if they've released it into the mainstream yet.
[ Parent
| on HN ]
Indeed, the blog post is an interesting read, but the premise is mistaken. Windows 11 is satisfied with TPM that is based in an AMD or Intel chip (arguably, that is even more secure than a discrete chip).
https://support.microsoft.com/en-us/windows/enable-tpm-2-0-o...
Re:Home Made TPM2.0 Module
by cryptonector on Saturday May 07, 2022 @11:18PM
(#31300946)
Not only that, but TPM chips are hopelessly physically insecure because of bootstrapping issues. But firmware TPMs (fTPMs), which run in a secure enclave or ME, do not have those issues at all.
The bootstrapping issues are namely that the BMC and BIOS don't necessarily and securely know a public key for the TPM they're talking to, so generally they don't even bother encrypting sessions to the TPM, and even if they did, they'd be subject to MITM attacks as long as they don't know the TPM's public key a priori. The attacks on bootstrapping do require physical access, so it's not exactly the end of the world, but it's still not good. But again, fTPMs don't have these problems because the communications between the CPU and the fTPM are on-die, so there is no external bus that could be used for mounting an attack.
Re:Home Made TPM2.0 Module
by TheGoddessInari on Saturday May 07, 2022 @08:37AM
(#31294026)
Severe system stuttering while utilizing AMD fTPM has been one of the top complaints about Windows 11 up until now.
I read that the problem manifested only intermittently, which of course can be annoying enough. Supposedly AMD will be issuing a BIOS/UEFI update in May.
Even for Intel, it's been around since 2016 (Skylake).
But support depends on system/motherboard.
Despite not appearing on the CPU (i7-5557U, Broadwell) datasheet, my NUC5i7RYH supports TPM 2.0 after enabling "Intel Platform Trust Technology" in the BIOS, so at least in some cases, this goes back further than Skylake.