3 ms·
The whole point of a TPM is to reduce the possibility of a backdoor. And you do own the private key in a TPM, what makes you think you do not. Do you "own" the
by georgyo 5y ago
The whole point of a TPM is to reduce the possibility of a backdoor.
And you do own the private key in a TPM, what makes you think you do not. Do you "own" the private key on a U2F device or a yubikey or a tensor?
The special sauce of a TPM is the tracking of various parts of the the hardware.
No matter what, your boot loader is unencrypted. It MUST be read by the hardware to decrypt your actual OS. Without a TPM, you can modify the bootloader or the bios, or many other things that would allow an attacker access to your key.
With a TPM if anything is modified it will refuse to deliver the key. This is a level of security currently impossible without it.
- willis936 5y agoTPMs have a private key permanently burned into them at the factory. I have to trust that the manufacturer will not use their ability to know what the key is.
- 0xcde4c3db 5y agoThey do? I was under the impression that TPM was specifically designed to be able to be re-keyed, with the only permanent keys being "endorsement keys" used to verify the TPM's origin and identity (e.g. that someone didn't sneak in and steal your TPM or replace it with an attacker-controlled facsimile).
- georgyo 5y agoI am fairly sure you are incorrect. But TPM information and documentation are unfortunately almost always behind a NDA. It makes pointing to definitive information difficult.