4 ms·
Yeah, but the point of having a TPM isn't just to have hardware capable of storing keys and doing some cryptography (so you can e.g. sign a challenge without ex
by GTP 4y ago
Yeah, but the point of having a TPM isn't just to have hardware capable of storing keys and doing some cryptography (so you can e.g. sign a challenge without exposing the private key) but also an hardware that makes extracting the keys from it hard. With an Arduino you can get the first part, but I don't think you can also make it tamper resistant or tamper evident. But still a device that could be interesting to play with, just be aware of the reduced grade of security that you get
- willis936 4y agoIt isn't blanket reduced security. Rolling your own greatly reduces the odds of a supply chain attack on a simple, unauditable, single-point-of-failure piece of security hardware.
- Nextgrid 4y agoIt really depends on what your threat model is. For most people, the threat model is primarily malware attacks, against which even a homebrew TPM will protect. Ideally you'd want something that literally can't be reprogrammed from the host, but even then, since it's a custom-made device an attacker would need to manually reverse-engineer it to attack it so you'd still be safe against anything but a targeted attack. Of course, this assumes you even care about using the TPM in the first place. If you just want to satisfy Windows' requirement then security is not a concern at all.
- GTP 4y agoI don't agree about malware protection: a TPM woukd protect you from malware in the sense that it would prevent a malware from getting your keys, but currently the most widespread form of malware are ransomware for which a TPM can't do anything. Also attackers are rarely interested in getting your cryptographic keys, usually they are interested in getting your login details for some service, for which they use phishing