3 ms·
If you use a PIN w/ the TPM then the attack goes from "read bits off a bus" to "pull apart the TPM", which dramatically raises the bar. (That's not to say that
by EvanAnderson 5y ago
If you use a PIN w/ the TPM then the attack goes from "read bits off a bus" to "pull apart the TPM", which dramatically raises the bar. (That's not to say that it wouldn't be possible to add a hardware "implant" to record the bitstream from the TPM and put the unit back into service so that the user can unlock it.)
- tracker1 5y agoOf course, the next parts are appropriate backups, and securing said backups.
- EvanAnderson 5y agoIf you're talking about key backup Microsoft handles that in Active Directory environments by storing a recovery key in the Directory protected by an ACL that limits access. It would be really nice (If anybody from MSFT is reading this!) if they encrypted that key w/ a public key. At this point at least, they just store it there in plaintext.