4 ms·
> you should have an external password necessary to unlock the drive; not a TPM or tell microsoft to use tpm 2.0 features if they force us to use a tpm v2?
by merb 5y ago
> you should have an external password necessary to unlock the drive; not a TPM
or tell microsoft to use tpm 2.0 features if they force us to use a tpm v2?
- belorn 5y agoIf you know of tpm 2.0 features that have the disk encryption and decryption occurring in the TPM chip itself then please enlighten me. I have not heard of that. Using a tpm without such features in order to improve a disk encryption setup to the same or above that of a password is difficult and full of problems, and there are some distinct drawbacks. There is a reason why Microsoft bitlocker is primarily intended to protect a users home directory after they have provided a password. If the pin to the tpm is in clear text on the disk, and all the tpm is doing is converting that pin to a password to unlock the disk, the benefits are generally small.
- lostmsu 5y agoI find it interesting that because they used SPI sniffer, CPU memory encryption features would not have prevented the attack. Looks like all communications between PC components need to be encrypted
- jnwatson 5y agoThe key doesn’t need to be kept in the TPM. It just needs to be encrypted between the CPU and the TPM.
- merb 5y agoactually tpm 2.0 can build a secure communication channel to send the key to the cpu and thus makes that a unlikely attack. of course there are many more attack vectors, but this possible one can be prevented with a correct communication channel. https://trustedcomputinggroup.org/wp-content/uploads/TSS_ESAPI_v1p0_r08_pub.pdf https://trustedcomputinggroup.org/wp-content/uploads/TSS_ESA...