4 ms·

The TPM spec is fully open, but where do I get the CAD drawings for the TPM that goes in my gaming tower? Where can I audit the source code? Where can I upload

by xena 3y ago

The TPM spec is fully open, but where do I get the CAD drawings for the TPM that goes in my gaming tower? Where can I audit the source code? Where can I upload my own source code package to the TPM hardware?

CuriousCosmic 3y ago
depends on your motherboard. most gaming motherboards have a TPM2.0 slot on them and that TPM is connected over either LPC or SPI nowadays (some I2C). And of those, basically everyone is moving to the SPI interface. The exact pin-out of the slot depends on the motherboard but they are all basically minor variations on the pinout of a 13 pin (14 pin with 1 filled) or 20 pin connector. When you buy your motherboard you can find the full pinout in the manual. That gets you your connector to the motherboard. For the actual chip itself and the PCB layout, buy an infineon TPM2.0. They cost a few dollars at most. The docs that you can pull off the site include the pinout and operating condition requirements. From that you can build a simple board to run the chip. Hell most of the docs include the plans for one (albeit you might need to change that to fit your mobo. https://www.infineon.com/cms/en/product/security-smart-card-solutions/optiga-embedded-security-solutions/optiga-tpm/ https://www.infineon.com/cms/en/product/security-smart-card-...
- pgeorgi 3y ago
  > most gaming motherboards have a TPM2.0 slot on them and that TPM is connected over either LPC or SPI nowadays Mostly these days it's an fTPM, implemented in firmware (ME or AMD's "Security Processor") especially when it comes to TPM2.0 which is an entirely new madness of complexity hell compared to TPM1.
  - CuriousCosmic 3y ago
    It shouldn't be? I got a new AM4 board a year or two ago and almost every board on the market at the time had TPM2.0 slots. The issue was that they aren't advertised and barely mentioned but they were there. From taking a quick search, I selected the first AM5 motherboard I saw from ASRock, MSI, Gigabyte, and ASUS. All had TPM headers buried in the specs or only listed in the manual. Caveat that with ASUS it seems the ROG boards don't have TPM headers but the equivalent ASUS non-ROG boards consistently do. Point being that they are still quite common and if that's a feature you care about, it's easy to accommodate in any build without even having to look for a different brand. The only issue is that they aren't well advertised or advertised at all.
adql 3y ago
What "cad drawings?" it's standard pinout bare board, as long as you use like, a chip and not 10 it will fill
- xena 3y ago
  Something that I can send to PCBWay.
  - MayeulC 3y ago
    Pretty sure you can just make a software implementation on an Arduino or some microcontroller, and connect it to the SPI bus. Of course, it would be relatively easy to extract the keys from an Arduino's flash memory, which undermines the whole concept. An attacker stealing your desktop shouldn't be able to access anything stored in the TPM. It's like a USB stick, but more secure, and for just a tiny bit of data. A Yubikey is some kind of TPM. In principle, it cannot be cloned if it falls into the wrong hands. Anybody is welcome to build their own, and they are kind of dumb storage elements (that can also encrypt data you send them), it is just not easy to extract data from them.
  - pgeorgi 3y ago
    The firmware for the TPM(+a few functions more) chip in Chromebooks is Open Source. There was a presentation on it in 2018 whose slides can be found on https://web.archive.org/web/20211120005203/https://2018.osfc.io/uploads/talk/paper/7/gsc_copy.pdf https://web.archive.org/web/20211120005203/https://2018.osfc... You'd have to adapt it to the SoC you're running it on though. Have fun.
arthur2e5 3y ago
It's a small chip connected to the motherboard via either the LPC bus or the SPI bus. There is no constraint on size except the bus dimension and common sense. If you want to draw a PCB, you can! Just like you can make your own USB-to-SATA board with an ASM1153 though, all you do is draw a board to connect a chip to the outside and give it some supporting crystals. An example TPM chip is SLB 9665, and you can get its datasheet here: https://www.infineon.com/dgdl/Infineon-data-sheet-SLB9665_2.0_Rev1.2-DS-v01_02-EN.pdf?fileId=5546d462689a790c016929d1d3054feb https://www.infineon.com/dgdl/Infineon-data-sheet-SLB9665_2.... (if link goes stale, use Google) As for source code: hardware being closed off is not exactly news (otherwise people would be a lot less angry at firmware issues). There are open-source TPM emulators in use by qemu, so you probably could convince a Raspberry Pi Zero or whatever to pretend to be one by using an emulator and speaking over SPI. There's also a report of TPM on a ARM+FPGA board (https://scholarsarchive.byu.edu/cgi/viewcontent.cgi?article=7298&context=etd https://scholarsarchive.byu.edu/cgi/viewcontent.cgi?article=...) if that's what you want.

by xena 3y ago

CuriousCosmic 3y ago

depends on your motherboard. most gaming motherboards have a TPM2.0 slot on them and that TPM is connected over either LPC or SPI nowadays (some I2C). And of those, basically everyone is moving to the SPI interface. The exact pin-out of the slot depends on the motherboard but they are all basically minor variations on the pinout of a 13 pin (14 pin with 1 filled) or 20 pin connector. When you buy your motherboard you can find the full pinout in the manual. That gets you your connector to the motherboard. For the actual chip itself and the PCB layout, buy an infineon TPM2.0. They cost a few dollars at most. The docs that you can pull off the site include the pinout and operating condition requirements. From that you can build a simple board to run the chip. Hell most of the docs include the plans for one (albeit you might need to change that to fit your mobo. https://www.infineon.com/cms/en/product/security-smart-card-solutions/optiga-embedded-security-solutions/optiga-tpm/ https://www.infineon.com/cms/en/product/security-smart-card-...

pgeorgi 3y ago
> most gaming motherboards have a TPM2.0 slot on them and that TPM is connected over either LPC or SPI nowadays Mostly these days it's an fTPM, implemented in firmware (ME or AMD's "Security Processor") especially when it comes to TPM2.0 which is an entirely new madness of complexity hell compared to TPM1.
- CuriousCosmic 3y ago
  It shouldn't be? I got a new AM4 board a year or two ago and almost every board on the market at the time had TPM2.0 slots. The issue was that they aren't advertised and barely mentioned but they were there. From taking a quick search, I selected the first AM5 motherboard I saw from ASRock, MSI, Gigabyte, and ASUS. All had TPM headers buried in the specs or only listed in the manual. Caveat that with ASUS it seems the ROG boards don't have TPM headers but the equivalent ASUS non-ROG boards consistently do. Point being that they are still quite common and if that's a feature you care about, it's easy to accommodate in any build without even having to look for a different brand. The only issue is that they aren't well advertised or advertised at all.

adql 3y ago

What "cad drawings?" it's standard pinout bare board, as long as you use like, a chip and not 10 it will fill

xena 3y ago
Something that I can send to PCBWay.
- MayeulC 3y ago
  Pretty sure you can just make a software implementation on an Arduino or some microcontroller, and connect it to the SPI bus. Of course, it would be relatively easy to extract the keys from an Arduino's flash memory, which undermines the whole concept. An attacker stealing your desktop shouldn't be able to access anything stored in the TPM. It's like a USB stick, but more secure, and for just a tiny bit of data. A Yubikey is some kind of TPM. In principle, it cannot be cloned if it falls into the wrong hands. Anybody is welcome to build their own, and they are kind of dumb storage elements (that can also encrypt data you send them), it is just not easy to extract data from them.
- pgeorgi 3y ago
  The firmware for the TPM(+a few functions more) chip in Chromebooks is Open Source. There was a presentation on it in 2018 whose slides can be found on https://web.archive.org/web/20211120005203/https://2018.osfc.io/uploads/talk/paper/7/gsc_copy.pdf https://web.archive.org/web/20211120005203/https://2018.osfc... You'd have to adapt it to the SoC you're running it on though. Have fun.

arthur2e5 3y ago

It's a small chip connected to the motherboard via either the LPC bus or the SPI bus. There is no constraint on size except the bus dimension and common sense. If you want to draw a PCB, you can! Just like you can make your own USB-to-SATA board with an ASM1153 though, all you do is draw a board to connect a chip to the outside and give it some supporting crystals. An example TPM chip is SLB 9665, and you can get its datasheet here: https://www.infineon.com/dgdl/Infineon-data-sheet-SLB9665_2.0_Rev1.2-DS-v01_02-EN.pdf?fileId=5546d462689a790c016929d1d3054feb https://www.infineon.com/dgdl/Infineon-data-sheet-SLB9665_2.... (if link goes stale, use Google) As for source code: hardware being closed off is not exactly news (otherwise people would be a lot less angry at firmware issues). There are open-source TPM emulators in use by qemu, so you probably could convince a Raspberry Pi Zero or whatever to pretend to be one by using an emulator and speaking over SPI. There's also a report of TPM on a ARM+FPGA board (https://scholarsarchive.byu.edu/cgi/viewcontent.cgi?article=7298&context=etd https://scholarsarchive.byu.edu/cgi/viewcontent.cgi?article=...) if that's what you want.