3 ms·

And that horrible situation was only done because the purchasers never got the owner TPM key. This could have been solved if the "computer purchaser" == "compu

And that horrible situation was only done because the purchasers never got the owner TPM key. This could have been solved if the "computer purchaser" == "computer owner". Instead, you buy hardware but Intel and who else the fuck other owns the rights to functionality. I went with AMD for my recent computer. The TPM is a separate module that you have to purchase and slot on the motherboard. I didn't get one.

aseipp 8y ago
If you are using Ryzen, then the PSP contains a firmware implementation of a TPM 2.0 chip anyway. All Ryzen chips are equipped with this. On certain BIOSes, you can turn off the PSP functionality that enables the fTPM, from my understanding (this also disables other functionality, such as encryption offload). But you can also just ignore a TPM anyway, there's nothing mandating you use it, even if it's there. SGX is somewhat similar, since some cooperation is needed by the operating system to launch enclaves anyway (AFAIU), even if the enclaves are intel-signed, and the user has to authorize that (unless just random unprivileged users can install enclaves willy-nilly, but that seems like a bad idea). SGX doesn't really seem to add much to any realistic threat model where "Intel is your enemy", given that threat model presumably already includes the Management engine (or AMD PSP) anyway, if it was really your worry. So you were already getting screwed long before this, really -- in such a scenario, they were able to launch undetectable code long before this. SGX-enabled boot-based malware seems like a much more problematic case that's possible, but given how effective the most basic Ransomware, etc seems to be already without these features, I'm not sure most malware authors need significantly more advanced techniques than this. You're probably screwed anyway.

3 ms·

And that horrible situation was only done because the purchasers never got the owner TPM key. This could have been solved if the "computer purchaser" == "compu

by crankylinuxuser 8y ago

aseipp 8y ago
If you are using Ryzen, then the PSP contains a firmware implementation of a TPM 2.0 chip anyway. All Ryzen chips are equipped with this. On certain BIOSes, you can turn off the PSP functionality that enables the fTPM, from my understanding (this also disables other functionality, such as encryption offload). But you can also just ignore a TPM anyway, there's nothing mandating you use it, even if it's there. SGX is somewhat similar, since some cooperation is needed by the operating system to launch enclaves anyway (AFAIU), even if the enclaves are intel-signed, and the user has to authorize that (unless just random unprivileged users can install enclaves willy-nilly, but that seems like a bad idea). SGX doesn't really seem to add much to any realistic threat model where "Intel is your enemy", given that threat model presumably already includes the Management engine (or AMD PSP) anyway, if it was really your worry. So you were already getting screwed long before this, really -- in such a scenario, they were able to launch undetectable code long before this. SGX-enabled boot-based malware seems like a much more problematic case that's possible, but given how effective the most basic Ransomware, etc seems to be already without these features, I'm not sure most malware authors need significantly more advanced techniques than this. You're probably screwed anyway.