12 ms·
> with TPM, you can put your own keys, and use the TPM to refuse payloads not signed with your keys (ex: a Windows install thumbdrive) No, that's UEFI Secure B
by mjg59 4y ago
> with TPM, you can put your own keys, and use the TPM to refuse payloads not signed with your keys (ex: a Windows install thumbdrive)
No, that's UEFI Secure Boot, which doesn't use the TPM - it's entirely handled on-CPU. Most of the keys on a TPM are under user control (but aren't involved in the boot process) other than the EK, which is generated at manufacture time and will be consistent for the lifetime of the TPM.
- csdvrx 4y agoIndeed, it's s simplification. If you want to go down the TPM rabbit hole, read this interesting comment about IEEE 1667: https://github.com/MicrosoftDocs/windows-itpro-docs/issues/5429#issuecomment-554661734 https://github.com/MicrosoftDocs/windows-itpro-docs/issues/5...