3 ms·
Even if flawed, it can still act as a safety in numbers game. You have to be able to abuse TPM and be in a position to do so, in the context of fde, even a flaw
by hsbauauvhabzb 3y ago
Even if flawed, it can still act as a safety in numbers game. You have to be able to abuse TPM and be in a position to do so, in the context of fde, even a flawed tpm v1 approach stops 90% of potential threat actors capable of abusing an unencrypted device.
- motohagiography 3y agoA solution that was rarely implemented was batch keys, where your secrets installed by the OEM were diversified somehow so when attackers eventually extracted your TPM secrets from one device, it would not compromise all devices. It still has a terrible and unacceptable failure mode when peoples lives depend on it, but for infrastructure, I think the risk is more managable.
- hsbauauvhabzb 3y agoIf your threat model involves people sniffing TPM signals in transit, you’re in a different league to me. In most cases I assume physical security (security guards, epoxy the motherboard, etc) become the mitigating factors. I’m just trying to avoid evil maids.
- loup-vaillant 3y agoMaking an TPM genie isn’t that hard, and once we have that the Evil Maid can fairly easily unplug the discrete TPM, plug the Genie, and plug the TPM into the genie. And voilà, you can now sniff TPM signals in transit. Only works with discrete TPMs of course, but Man-in-the-Middle is not out of this world. https://github.com/nccgroup/TPMGenie https://github.com/nccgroup/TPMGenie
- hsbauauvhabzb 3y agoI’m more referring to laptops. If you’re using a desktop, you also have other issues (like key injectors unless you inspect the cable going from your pc to your desk every time, etc).