4 ms·

>Not every device has the necessary hardware, though; most desktops don't have it, so they would need to rely on external hardware such as USB keys. How?!? The

>Not every device has the necessary hardware, though; most desktops don't have it, so they would need to rely on external hardware such as USB keys. How?!? There's been an fTPM built into CPUs since Haswell on the Intel side and on the AMD side since before Ryzen. If you OEM it's enabled automatically if you bought a machine after July 28, 2016. If you DIY you literally have to flick one switch in the BIOS if it's not enabled automatically.

_cenw 4y ago
Intel only added PTT - their soft TPM - with Coffee Lake.
jeroenhd 4y ago
I know it has been, but Windows Hello doesn't seem to be available for my 7700k after explicitly enabling the fTPM. I think it requires TPM 2.0 support, which hasn't been supported for all that long.
- waboremo 4y ago
  Windows Hello doesn't require 2.0, it works on 1.2. There is something interesting regarding the 7700k though on windows (especially 11), users have been claiming windows reports it as supporting TPM 2.0 but they still can't upgrade to windows 11 due to failing requirements. So I wonder if something else is happening there that also seems to be affecting windows hello for you, because on paper at least for windows 10 you should be able to use Hello no problem.
  - Veliladon 4y ago
    You're thinking of HVCI which requires Mode Based Execution Control only available on 8th gen Intel or later and Zen 2 or later.
  - jeroenhd 4y ago
    My CPU doesn't support TPM 2.0 with fTPM (and the motherboard manufacturer stopped selling TPMs for my motherboard years ago) so I'm sticking with Windows 10. It told me I could upgrade at some point but that was a false positive. Maybe my install is just broken in some way. However, I do know that I had to manually enable the fTPM functionality on my motherboard and I highly doubt the average consumer is going to enable such features in their BIOS. I don't know when manufacturers started enabling fTPM support by default, but it's definitely not enabled by default in most 7th gen Intel boards and I doubt 8th gen changed much in that sense.
Macha 4y ago
With that said, after a nasty experience with the zen 2 fTPM repeatedly resetting, I have a hard time trusting the reliability of the AMD fTPM.
cryptonector 4y ago
I'm not sure if fTPMs have endorsement key certificates. I should know, but mostly I work with dTPMs and vTPMs. Not that an fTPM not having an EK certificate is a big deal -- if you bootstrap a public key for it early enough in OS installation, you can just trust the fTPM.

_cenw 4y ago

Intel only added PTT - their soft TPM - with Coffee Lake.

jeroenhd 4y ago

I know it has been, but Windows Hello doesn't seem to be available for my 7700k after explicitly enabling the fTPM. I think it requires TPM 2.0 support, which hasn't been supported for all that long.

waboremo 4y ago
Windows Hello doesn't require 2.0, it works on 1.2. There is something interesting regarding the 7700k though on windows (especially 11), users have been claiming windows reports it as supporting TPM 2.0 but they still can't upgrade to windows 11 due to failing requirements. So I wonder if something else is happening there that also seems to be affecting windows hello for you, because on paper at least for windows 10 you should be able to use Hello no problem.
- Veliladon 4y ago
  You're thinking of HVCI which requires Mode Based Execution Control only available on 8th gen Intel or later and Zen 2 or later.
- jeroenhd 4y ago
  My CPU doesn't support TPM 2.0 with fTPM (and the motherboard manufacturer stopped selling TPMs for my motherboard years ago) so I'm sticking with Windows 10. It told me I could upgrade at some point but that was a false positive. Maybe my install is just broken in some way. However, I do know that I had to manually enable the fTPM functionality on my motherboard and I highly doubt the average consumer is going to enable such features in their BIOS. I don't know when manufacturers started enabling fTPM support by default, but it's definitely not enabled by default in most 7th gen Intel boards and I doubt 8th gen changed much in that sense.

Macha 4y ago

With that said, after a nasty experience with the zen 2 fTPM repeatedly resetting, I have a hard time trusting the reliability of the AMD fTPM.

cryptonector 4y ago

I'm not sure if fTPMs have endorsement key certificates. I should know, but mostly I work with dTPMs and vTPMs. Not that an fTPM not having an EK certificate is a big deal -- if you bootstrap a public key for it early enough in OS installation, you can just trust the fTPM.