The TPM spec is fully open, but where do I get the CAD drawings for the TPM that goes in my gaming tower? Where can I audit the source code? Where can I upload my own source code package to the TPM hardware?

It's a small chip connected to the motherboard via either the LPC bus or the SPI bus. There is no constraint on size except the bus dimension and common sense.

If you want to draw a PCB, you can! Just like you can make your own USB-to-SATA board with an ASM1153 though, all you do is draw a board to connect a chip to the outside and give it some supporting crystals. An example TPM chip is SLB 9665, and you can get its datasheet here: https://www.infineon.com/dgdl/Infineon-data-sheet-SLB9665_2.... (if link goes stale, use Google)

As for source code: hardware being closed off is not exactly news (otherwise people would be a lot less angry at firmware issues). There are open-source TPM emulators in use by qemu, so you probably could convince a Raspberry Pi Zero or whatever to pretend to be one by using an emulator and speaking over SPI. There's also a report of TPM on a ARM+FPGA board (https://scholarsarchive.byu.edu/cgi/viewcontent.cgi?article=...) if that's what you want.

What "cad drawings?" it's standard pinout bare board, as long as you use like, a chip and not 10 it will fill

Something that I can send to PCBWay.

Pretty sure you can just make a software implementation on an Arduino or some microcontroller, and connect it to the SPI bus. Of course, it would be relatively easy to extract the keys from an Arduino's flash memory, which undermines the whole concept. An attacker stealing your desktop shouldn't be able to access anything stored in the TPM.

It's like a USB stick, but more secure, and for just a tiny bit of data. A Yubikey is some kind of TPM. In principle, it cannot be cloned if it falls into the wrong hands. Anybody is welcome to build their own, and they are kind of dumb storage elements (that can also encrypt data you send them), it is just not easy to extract data from them.

The firmware for the TPM(+a few functions more) chip in Chromebooks is Open Source. There was a presentation on it in 2018 whose slides can be found on https://web.archive.org/web/20211120005203/https://2018.osfc...

You'd have to adapt it to the SoC you're running it on though. Have fun.

depends on your motherboard. most gaming motherboards have a TPM2.0 slot on them and that TPM is connected over either LPC or SPI nowadays (some I2C). And of those, basically everyone is moving to the SPI interface.

The exact pin-out of the slot depends on the motherboard but they are all basically minor variations on the pinout of a 13 pin (14 pin with 1 filled) or 20 pin connector. When you buy your motherboard you can find the full pinout in the manual. That gets you your connector to the motherboard.

For the actual chip itself and the PCB layout, buy an infineon TPM2.0. They cost a few dollars at most. The docs that you can pull off the site include the pinout and operating condition requirements. From that you can build a simple board to run the chip. Hell most of the docs include the plans for one (albeit you might need to change that to fit your mobo.

https://www.infineon.com/cms/en/product/security-smart-card-...

> most gaming motherboards have a TPM2.0 slot on them and that TPM is connected over either LPC or SPI nowadays

Mostly these days it's an fTPM, implemented in firmware (ME or AMD's "Security Processor") especially when it comes to TPM2.0 which is an entirely new madness of complexity hell compared to TPM1.

It shouldn't be? I got a new AM4 board a year or two ago and almost every board on the market at the time had TPM2.0 slots. The issue was that they aren't advertised and barely mentioned but they were there.

From taking a quick search, I selected the first AM5 motherboard I saw from ASRock, MSI, Gigabyte, and ASUS. All had TPM headers buried in the specs or only listed in the manual. Caveat that with ASUS it seems the ROG boards don't have TPM headers but the equivalent ASUS non-ROG boards consistently do.

Point being that they are still quite common and if that's a feature you care about, it's easy to accommodate in any build without even having to look for a different brand. The only issue is that they aren't well advertised or advertised at all.

Exactly, my Librem 15 can use TPM with my keys and free software.

By your logic, wouldn't EME be a good thing too, since its spec is also fully open?

Open source emulators implementing ME or TPM or whatever is not a problem, so long the user retains full control of private keys. Or if it’ll be even less of a problem if ME CPU is going to be emulated too, because then the community will get to record the evil overlord doing its thing.

> not a problem, so long the user retains full control of private keys

The whole point of these technologies is to transfer control of the user's computer to various other actors. So in practice this condition (the user retaining control) is not going to be true, so they remain problematic.

While this use might be common, it's far from "the whole point".

To avoid evil maid attacks, there isn't much of an alternative.

I said EME (Encrypted Media Extensions), not ME (Management Engine).

No. I like TPMs. I hate DRMs.

TPMs help me have a secure (as in preventing evil maid AND being forensics proof) computer to use. The current TPM2.0 specification had some problems (external TPMs are easy to MITM), so I can't trust it to hold my disk encryption keys. But it still HELPS A LOT in mitigating my risk of typing in my FDE keys into a phishing prompt.

DRMs contribute to worse and worse media playing experience.

Is it this hard to tell apart?

TPMs would be a good thing if they didn't allow remote attestation. That would give you all of the legitimate security benefits you want, while making them useless for evil purposes.

TPM enables remote attestation.