6 ms·

TPM spec is fully open. Stop FUD.

by rfoo 3y ago

josephcsible 3y ago
By your logic, wouldn't EME be a good thing too, since its spec is also fully open?
- numpad0 3y ago
  Open source emulators implementing ME or TPM or whatever is not a problem, so long the user retains full control of private keys. Or if it’ll be even less of a problem if ME CPU is going to be emulated too, because then the community will get to record the evil overlord doing its thing.
  - ptx 3y ago
    > not a problem, so long the user retains full control of private keys The whole point of these technologies is to transfer control of the user's computer to various other actors. So in practice this condition (the user retaining control) is not going to be true, so they remain problematic.
    - snvzz 3y ago
      While this use might be common, it's far from "the whole point". To avoid evil maid attacks, there isn't much of an alternative.
  - josephcsible 3y ago
    I said EME (Encrypted Media Extensions), not ME (Management Engine).
    - rfoo 3y ago
      No. I like TPMs. I hate DRMs. TPMs help me have a secure (as in preventing evil maid AND being forensics proof) computer to use. The current TPM2.0 specification had some problems (external TPMs are easy to MITM), so I can't trust it to hold my disk encryption keys. But it still HELPS A LOT in mitigating my risk of typing in my FDE keys into a phishing prompt. DRMs contribute to worse and worse media playing experience. Is it this hard to tell apart?
      - josephcsible 3y ago
        TPMs would be a good thing if they didn't allow remote attestation. That would give you all of the legitimate security benefits you want, while making them useless for evil purposes.
hospitalhusband 3y ago
TPM enables remote attestation.
xena 3y ago
The TPM spec is fully open, but where do I get the CAD drawings for the TPM that goes in my gaming tower? Where can I audit the source code? Where can I upload my own source code package to the TPM hardware?
- CuriousCosmic 3y ago
  depends on your motherboard. most gaming motherboards have a TPM2.0 slot on them and that TPM is connected over either LPC or SPI nowadays (some I2C). And of those, basically everyone is moving to the SPI interface. The exact pin-out of the slot depends on the motherboard but they are all basically minor variations on the pinout of a 13 pin (14 pin with 1 filled) or 20 pin connector. When you buy your motherboard you can find the full pinout in the manual. That gets you your connector to the motherboard. For the actual chip itself and the PCB layout, buy an infineon TPM2.0. They cost a few dollars at most. The docs that you can pull off the site include the pinout and operating condition requirements. From that you can build a simple board to run the chip. Hell most of the docs include the plans for one (albeit you might need to change that to fit your mobo. https://www.infineon.com/cms/en/product/security-smart-card-solutions/optiga-embedded-security-solutions/optiga-tpm/ https://www.infineon.com/cms/en/product/security-smart-card-...
  - pgeorgi 3y ago
    > most gaming motherboards have a TPM2.0 slot on them and that TPM is connected over either LPC or SPI nowadays Mostly these days it's an fTPM, implemented in firmware (ME or AMD's "Security Processor") especially when it comes to TPM2.0 which is an entirely new madness of complexity hell compared to TPM1.
    - CuriousCosmic 3y ago
      It shouldn't be? I got a new AM4 board a year or two ago and almost every board on the market at the time had TPM2.0 slots. The issue was that they aren't advertised and barely mentioned but they were there. From taking a quick search, I selected the first AM5 motherboard I saw from ASRock, MSI, Gigabyte, and ASUS. All had TPM headers buried in the specs or only listed in the manual. Caveat that with ASUS it seems the ROG boards don't have TPM headers but the equivalent ASUS non-ROG boards consistently do. Point being that they are still quite common and if that's a feature you care about, it's easy to accommodate in any build without even having to look for a different brand. The only issue is that they aren't well advertised or advertised at all.
fsflover 3y ago
Exactly, my Librem 15 can use TPM with my keys and free software.

TPM spec is fully open. Stop FUD.

by rfoo 3y ago

TPM spec is fully open. Stop FUD.

josephcsible 3y ago

By your logic, wouldn't EME be a good thing too, since its spec is also fully open?

numpad0 3y ago
Open source emulators implementing ME or TPM or whatever is not a problem, so long the user retains full control of private keys. Or if it’ll be even less of a problem if ME CPU is going to be emulated too, because then the community will get to record the evil overlord doing its thing.
- ptx 3y ago
  > not a problem, so long the user retains full control of private keys The whole point of these technologies is to transfer control of the user's computer to various other actors. So in practice this condition (the user retaining control) is not going to be true, so they remain problematic.
  - snvzz 3y ago
    While this use might be common, it's far from "the whole point". To avoid evil maid attacks, there isn't much of an alternative.
- josephcsible 3y ago
  I said EME (Encrypted Media Extensions), not ME (Management Engine).
  - rfoo 3y ago
    No. I like TPMs. I hate DRMs. TPMs help me have a secure (as in preventing evil maid AND being forensics proof) computer to use. The current TPM2.0 specification had some problems (external TPMs are easy to MITM), so I can't trust it to hold my disk encryption keys. But it still HELPS A LOT in mitigating my risk of typing in my FDE keys into a phishing prompt. DRMs contribute to worse and worse media playing experience. Is it this hard to tell apart?
    - josephcsible 3y ago
      TPMs would be a good thing if they didn't allow remote attestation. That would give you all of the legitimate security benefits you want, while making them useless for evil purposes.

hospitalhusband 3y ago

TPM enables remote attestation.

xena 3y ago

The TPM spec is fully open, but where do I get the CAD drawings for the TPM that goes in my gaming tower? Where can I audit the source code? Where can I upload my own source code package to the TPM hardware?

CuriousCosmic 3y ago
depends on your motherboard. most gaming motherboards have a TPM2.0 slot on them and that TPM is connected over either LPC or SPI nowadays (some I2C). And of those, basically everyone is moving to the SPI interface. The exact pin-out of the slot depends on the motherboard but they are all basically minor variations on the pinout of a 13 pin (14 pin with 1 filled) or 20 pin connector. When you buy your motherboard you can find the full pinout in the manual. That gets you your connector to the motherboard. For the actual chip itself and the PCB layout, buy an infineon TPM2.0. They cost a few dollars at most. The docs that you can pull off the site include the pinout and operating condition requirements. From that you can build a simple board to run the chip. Hell most of the docs include the plans for one (albeit you might need to change that to fit your mobo. https://www.infineon.com/cms/en/product/security-smart-card-solutions/optiga-embedded-security-solutions/optiga-tpm/ https://www.infineon.com/cms/en/product/security-smart-card-...
- pgeorgi 3y ago
  > most gaming motherboards have a TPM2.0 slot on them and that TPM is connected over either LPC or SPI nowadays Mostly these days it's an fTPM, implemented in firmware (ME or AMD's "Security Processor") especially when it comes to TPM2.0 which is an entirely new madness of complexity hell compared to TPM1.
  - CuriousCosmic 3y ago
    It shouldn't be? I got a new AM4 board a year or two ago and almost every board on the market at the time had TPM2.0 slots. The issue was that they aren't advertised and barely mentioned but they were there. From taking a quick search, I selected the first AM5 motherboard I saw from ASRock, MSI, Gigabyte, and ASUS. All had TPM headers buried in the specs or only listed in the manual. Caveat that with ASUS it seems the ROG boards don't have TPM headers but the equivalent ASUS non-ROG boards consistently do. Point being that they are still quite common and if that's a feature you care about, it's easy to accommodate in any build without even having to look for a different brand. The only issue is that they aren't well advertised or advertised at all.

fsflover 3y ago

Exactly, my Librem 15 can use TPM with my keys and free software.