3 ms·
It'll be built into the CPU, instead of having a separate chip, and seems to have secret-management functionality for user-specified keys, biometrics, etc.
by warkdarrior 6y ago
It'll be built into the CPU, instead of having a separate chip, and seems to have secret-management functionality for user-specified keys, biometrics, etc.
- gruez 6y ago>It'll be built into the CPU, instead of having a separate chip so are the trusted execution environments used by fTPMs? >seems to have secret-management functionality for user-specified keys AFAIK TPMs already have that functionality. random search: https://github.com/tpm2-software/tpm2-tools/blob/master/man/tpm2_import.1.md https://github.com/tpm2-software/tpm2-tools/blob/master/man/... >biometrics, etc. AFAIK some fingerprint readers already use trusted execution environments to handle authentication, so from a feature point of view there isn't really anything new here.
- canada_dry 6y agoThe huge difference, and most tin-foil-hat worthy, is that all this functionality is extended to reach the cloud. What's frightening is that - by design - the user will have little/no control or even awareness of what data is being sent or received.
- dathinab 6y agoThat's most likely based on attestation. Which means the OS still have full control over what it does send but the "thing" can attest that what the OS sends is valid and not made up.
- floatboth 6y ago> so are the trusted execution environments used by fTPMs? AMD PSP for sure is. I think I might have heard something about Intel ME being on the PCH in some cases??? Anyway seems like the point is to make it a "more hardware" TPM rather than a firmware one – i.e. the key memory would only be accessible from fixed function crypto hardware blocks. Coincidentally, this might mean that the embedded TPM would still work after me_cleaner destroys most of the ME firmware :)