3 ms·
Smartcard can't do self lockout at HW modification and other TPM features so not equivalent. Still, it should be able to use as additional key to password only
by fomine3 5y ago
Smartcard can't do self lockout at HW modification and other TPM features so not equivalent. Still, it should be able to use as additional key to password only BitLocker, but then maybe lack of Smartcard driver at UEFI is a blocker.
- xaduha 5y agoIt doesn't have to be an equivalent to be an option. Just like having no encryption is an option or auto-unlocking is an option. It's not like TPM detects that there are hardware changes, Windows itself does and it can lock it down. Or if there is some mechanism it doesn't seem to help in this case, so who is it stopping?
- pgeorgi 5y agoTPMs are notified about the system state along the boot process, so they can present the key only if the boot process looks like it's supposed to (and some of these attributes aren't even modifiable by the CPU but the side processor, e.g. Intel's "Management" Engine or AMD's "Security" Processor, so even taking over the x86 firmware doesn't help anymore) Smartcards lack that data (they wouldn't know that somebody attached a Thunderbolt device that pretends to be a GPU but also comes with its own option ROM that installed a backdoor), so they serve a different threat model.
- xaduha 5y agoAnd now the whole 'separate TPM' thing is obsolete, because newer processors will come with their own TPMs. This was a bad idea from the start if you ask me, with UEFI and shoving all sorts of things into it.