Intel Open-Sources New TPM2 Software Stack

[pal666]

"Used for full disk encryption" only by people who earnestly believe that their few-cents-TPM chip could encrypt/decrypt data at the I/O rate of modern NVMe storage. Less misguided people know that the CPU will need to know the symmetric encryption key basically all the time while the system is running, so it isn't any safer when it is also stored in the TPM

lol. with full disk encryption your cpu sees all decrypted data because without cpu you can't do anything. encryption is not against your cpu while it is running, it is against stealing drive and putting it in other computer

[pal666]

The problem is that the TPM hardware chip contains closed-source firmware, and is essentially a mini-computer. We don't know what it can access and what it's doing. All we know is that we can securely store and retrieve keys - but no way of knowing if it's actually secure, and whether or not there are backdoors.

all hardware inside your computer is closed source and you don't know what it can access and what it's doing. so nothing changed

[pal666]

There are those of us that want freedom and believe people are smart enough do decide what is best for them

in real world most people are dumb and easily manipulated

[pal666]

Does anyone know if there are any other hardware providers?

https://en.wikipedia.org/wiki/Trusted_Platform_Module#Availability

[audir8]

The problem is that the TPM hardware chip contains closed-source firmware, and is essentially a mini-computer. We don't know what it can access and what it's doing. All we know is that we can securely store and retrieve keys - but no way of knowing if it's actually secure, and whether or not there are backdoors.

The TPM spec is open, the drivers are open, it doesn't have access to main memory like Intel ME does AFAICT under any number of it's modes and possible design applications. https://trustedcomputinggroup.org/re...specification/

It stores numbers securely, and either the BIOS or the OS (face/thumb print recognition etc..) can query these numbers given certain conditions. Secure key storage is a pretty old problem, If Atmel's TPM is insecure or has a backdoor, you can switch to others (giving Atmel enough reason to not do those things). These are basically the same guarantees you have with any peripheral connected to any I/O port on your computer. It's up to you if you want to store certain keys or not in a TPM, but I would say in most circumstances, it can make for an additional layer of security, that's just as importantly practical enough to use for the average user. I think they should be more widespread because of this.

[starshipeleven]

The problem is that the TPM hardware chip contains closed-source firmware, and is essentially a mini-computer. We don't know what it can access and what it's doing. All we know is that we can securely store and retrieve keys - but no way of knowing if it's actually secure, and whether or not there are backdoors.

TPM isn't a mini-computer, it's a hardware accelerator for some crypto functions, it has a RNG, and has secure storage for keys. Its bus has no access to a damn.

[Guest]

The TPM spec is open, the drivers are open, it doesn't have access to main memory like Intel ME does AFAICT under any number of it's modes and possible design applications. https://trustedcomputinggroup.org/re...specification/

It stores numbers securely, and either the BIOS or the OS (face/thumb print recognition etc..) can query these numbers given certain conditions. Secure key storage is a pretty old problem, If Atmel's TPM is insecure or has a backdoor, you can switch to others (giving Atmel enough reason to not do those things). These are basically the same guarantees you have with any peripheral connected to any I/O port on your computer. It's up to you if you want to store certain keys or not in a TPM, but I would say in most circumstances, it can make for an additional layer of security, that's just as importantly practical enough to use for the average user. I think they should be more widespread because of this.

I believe my Acer desktop uses Intel ME for the TPM. tpm.msc under Windows reported the TPM version to be the same version as the ME firmware (11.8.something), and upon using me_cleaner to set the HAP bit (gracefully disable Intel ME), the TPM could not be enabled again nor does the BIOS option reveal any options for it anymore.

[audir8]

I believe my Acer desktop uses Intel ME for the TPM. tpm.msc under Windows reported the TPM version to be the same version as the ME firmware (11.8.something), and upon using me_cleaner to set the HAP bit (gracefully disable Intel ME), the TPM could not be enabled again nor does the BIOS option reveal any options for it anymore.

This is probably true for some OEM manufacturers, but as the me_cleaner README notes, with enough reverse engineering you can get some functionality back, or not lose any functionality after flashing. I've yet to try it on my machines, but I look forward to finding out how ASUS/Lenovo do things when I do.

You can also get a TPM with coreboot in libre laptops: https://puri.sm/posts/tpm-addon-for-librem-laptops/

[starshipeleven]

I believe my Acer desktop uses Intel ME for the TPM. tpm.msc under Windows reported the TPM version to be the same version as the ME firmware (11.8.something), and upon using me_cleaner to set the HAP bit (gracefully disable Intel ME), the TPM could not be enabled again nor does the BIOS option reveal any options for it anymore.

That's a "software TPM". It is the cheapest of the possible TPM systems, and imho the worst one from a security standpoint.

[starshipeleven]

This is probably true for some OEM manufacturers, but as the me_cleaner README notes, with enough reverse engineering you can get some functionality back, or not lose any functionality after flashing. I've yet to try it on my machines, but I look forward to finding out how ASUS/Lenovo do things when I do.

You can also get a TPM with coreboot in libre laptops: https://puri.sm/posts/tpm-addon-for-librem-laptops/

If the device was using the ME for the TPM provider, you will lose the TPM if you neuter the ME. Because it's the ME that is the TPM in that system, there is no dedicated hardware.

But anwyay, who cares about TPM.