3 ms·
Such keys sold in large numbers could be detected and blacklisted though.
by wizee 3y ago
Such keys sold in large numbers could be detected and blacklisted though.
- blibble 3y agowhich will increases demand for keys, and will encourage increased economies of scale of extracting them would I pay $500 for a TPM key I can use to "attest" my hacked version of Chromium that removes ads? hell yes would cheaters pay $500 for a TPM key to bypass valorant anti-cheat? hell yes (they do already) would spammers pay $500 to spam Google? and so on ultimately attestation to control the user (vs. protect them) sows the seeds of its own demise
- kevincox 3y agoIIRC these keys are often produced in batches to help protect anonymity so revoking them may have undesirable impact on the bystanders who happen to have a key in the same batch. So if we could reliably extract keys it may be enough to break this. (or force TPM makers to have per-device keys instead of per-batch keys)
- rolph 3y agothats advantageous in the context of key spraying attacks, aiming to get as many possible keys blacklisted as forgeries, leading to large scale key losses. you dont have to know any keys just the structure of a valid key, then make things up according to spec