4 ms·

Related: a lot of AMD CPUs these days come with "fTPM", which is AMD's built-in TPM solution, voiding the need for an external module. Intel has something simil

Related: a lot of AMD CPUs these days come with "fTPM", which is AMD's built-in TPM solution, voiding the need for an external module. Intel has something similar that I forgot the name of, though I don't know if they've released it into the mainstream yet.

jhanschoo 5y ago
Indeed, the blog post is an interesting read, but the premise is mistaken. Windows 11 is satisfied with TPM that is based in an AMD or Intel chip (arguably, that is even more secure than a discrete chip). https://support.microsoft.com/en-us/windows/enable-tpm-2-0-on-your-pc-1fd5a332-360d-4f46-a1e7-ae6b0c90645c https://support.microsoft.com/en-us/windows/enable-tpm-2-0-o...
jethack 5y ago
Even for Intel, it's been around since 2016 (Skylake). But support depends on system/motherboard.
- jasomill 4y ago
  Despite not appearing on the CPU (i7-5557U, Broadwell) datasheet, my NUC5i7RYH supports TPM 2.0 after enabling "Intel Platform Trust Technology" in the BIOS, so at least in some cases, this goes back further than Skylake.
TheGoddessInari 5y ago
Severe system stuttering while utilizing AMD fTPM has been one of the top complaints about Windows 11 up until now.
- daneel_w 5y ago
  I read that the problem manifested only intermittently, which of course can be annoying enough. Supposedly AMD will be issuing a BIOS/UEFI update in May.
cryptonector 4y ago
Not only that, but TPM chips are hopelessly physically insecure because of bootstrapping issues. But firmware TPMs (fTPMs), which run in a secure enclave or ME, do not have those issues at all. The bootstrapping issues are namely that the BMC and BIOS don't necessarily and securely know a public key for the TPM they're talking to, so generally they don't even bother encrypting sessions to the TPM, and even if they did, they'd be subject to MITM attacks as long as they don't know the TPM's public key a priori. The attacks on bootstrapping do require physical access, so it's not exactly the end of the world, but it's still not good. But again, fTPMs don't have these problems because the communications between the CPU and the fTPM are on-die, so there is no external bus that could be used for mounting an attack.

jhanschoo 5y ago

Indeed, the blog post is an interesting read, but the premise is mistaken. Windows 11 is satisfied with TPM that is based in an AMD or Intel chip (arguably, that is even more secure than a discrete chip). https://support.microsoft.com/en-us/windows/enable-tpm-2-0-on-your-pc-1fd5a332-360d-4f46-a1e7-ae6b0c90645c https://support.microsoft.com/en-us/windows/enable-tpm-2-0-o...

jethack 5y ago

Even for Intel, it's been around since 2016 (Skylake). But support depends on system/motherboard.

jasomill 4y ago
Despite not appearing on the CPU (i7-5557U, Broadwell) datasheet, my NUC5i7RYH supports TPM 2.0 after enabling "Intel Platform Trust Technology" in the BIOS, so at least in some cases, this goes back further than Skylake.

TheGoddessInari 5y ago

Severe system stuttering while utilizing AMD fTPM has been one of the top complaints about Windows 11 up until now.

daneel_w 5y ago
I read that the problem manifested only intermittently, which of course can be annoying enough. Supposedly AMD will be issuing a BIOS/UEFI update in May.

cryptonector 4y ago

Not only that, but TPM chips are hopelessly physically insecure because of bootstrapping issues. But firmware TPMs (fTPMs), which run in a secure enclave or ME, do not have those issues at all. The bootstrapping issues are namely that the BMC and BIOS don't necessarily and securely know a public key for the TPM they're talking to, so generally they don't even bother encrypting sessions to the TPM, and even if they did, they'd be subject to MITM attacks as long as they don't know the TPM's public key a priori. The attacks on bootstrapping do require physical access, so it's not exactly the end of the world, but it's still not good. But again, fTPMs don't have these problems because the communications between the CPU and the fTPM are on-die, so there is no external bus that could be used for mounting an attack.