AMD's Firmware TPMs Vulnerable to Hardware Attacks, Defeating Disk Encryption

Re:AMD's Firmware TPMs Vulnerable to Hardware Attacks, Defea... by cryptonector on Tuesday May 02, 2023 @05:46PM (#35794662)

> By the way a dTPM should have a real entropy RNG so technically it shouldn't have any (usable) seed. It's basically a smartcard soldered onto the mainboard. Of course smartcards can also have key generation flaws like the Infineon flaw a while back. https://www.schneier.com/blog/archives/2017/10/security_flaw...

The seeds are an essential part of the TPM story as for generation (derivation) of primary keys, and being able to "take ownership" of a TPM by changing those seeds.

The seeds are not an essential part of the TPM story for its RNG. A TPM absolutely can and should have a solid HW RNG. Though, were I designing a TPM, I'd combine the output of a HW RNG w/ a PRNG seeded internally.

[ Parent | on HN ]

Re:AMD's Firmware TPMs Vulnerable to Hardware Attacks, Defea... by wkat4242 on Tuesday May 02, 2023 @06:30PM (#35795087)

But the seed itself should still be fully random though? And generated on-device during initialisation. Derived keys are a thing of course, and I understand the benefit thereof.

But a manufacturer-installed seed that they have control over sounds like a very bad idea.

[ Parent | on HN ]