3 ms·

Do you know if the motherboard has pins for a discrete TPM 2.0 module, e.g. https://www.asrock.com/mb/spec/product.asp?Model=TPM-SPI https://www.asrock.com/mb/s

Do you know if the motherboard has pins for a discrete TPM 2.0 module, e.g. https://www.asrock.com/mb/spec/product.asp?Model=TPM-SPI https://www.asrock.com/mb/spec/product.asp?Model=TPM-SPI & https://download.asrock.com/Manual/TPM-SPI.pdf https://download.asrock.com/Manual/TPM-SPI.pdf

zamadatix 2y ago
Does a discrete TPM offer specific advantages over an fTPM? I suppose it'd be modular but I can't really imagine trusting AMD to run the entire operating system but then saying they can't be trusted to hold a key and being fine with that in the same system. Not that I'm saying they are therefore perfectly secure rather I'm not sure what risks profiles it really avoids so perhaps other advantages exist too?
- transpute 2y ago
  Sadly, AMD PSP-based fTPMs emulate only a subset ("Mobile TPM" spec) of a discrete client TPM. This could be addressed with a PSP software update, since the Microsoft reference code for TPMs is open-source. A full TPM implementation is required to use DRTM (SKINIT) for measured Linux Secure Launch, which is useful for home servers to confirm that the boot loader, kernel and optional immutable OS/VMs have not been modified. Unlike "Secure Boot" SRTM, DRTM adds launch integrity with policy defined by the hardware owner. One would typically use SRTM+DRTM. The TPM emulation in Microsoft Pluton, which is present in some Ryzen chips, might be sufficient for DRTM. It's tragic that AMD fTPM has limited functionality, since AMD provides SKINIT on all SKUs, unlike Intel where TXT DRTM is limited to vPro. Some ASRock 4x4 (NUC-sized) mini PCs have pins for discrete TPM.
- yencabulator 2y ago
  Generally the other way, if you're paranoid -- the fact that it's separate component allows an attacker to MITM the communication.
c0l0 2y ago
Not according to the spec sheet or the PCB photos[0][1] they provide, no. [0]: https://www.asrock.com/nettop/photo/DeskMeet%20X600%20Series(L5).png https://www.asrock.com/nettop/photo/DeskMeet%20X600%20Series... [1]: https://www.asrock.com/nettop/photo/DeskMeet%20X600%20Series(L6).png https://www.asrock.com/nettop/photo/DeskMeet%20X600%20Series...

zamadatix 2y ago

Does a discrete TPM offer specific advantages over an fTPM? I suppose it'd be modular but I can't really imagine trusting AMD to run the entire operating system but then saying they can't be trusted to hold a key and being fine with that in the same system. Not that I'm saying they are therefore perfectly secure rather I'm not sure what risks profiles it really avoids so perhaps other advantages exist too?

transpute 2y ago
Sadly, AMD PSP-based fTPMs emulate only a subset ("Mobile TPM" spec) of a discrete client TPM. This could be addressed with a PSP software update, since the Microsoft reference code for TPMs is open-source. A full TPM implementation is required to use DRTM (SKINIT) for measured Linux Secure Launch, which is useful for home servers to confirm that the boot loader, kernel and optional immutable OS/VMs have not been modified. Unlike "Secure Boot" SRTM, DRTM adds launch integrity with policy defined by the hardware owner. One would typically use SRTM+DRTM. The TPM emulation in Microsoft Pluton, which is present in some Ryzen chips, might be sufficient for DRTM. It's tragic that AMD fTPM has limited functionality, since AMD provides SKINIT on all SKUs, unlike Intel where TXT DRTM is limited to vPro. Some ASRock 4x4 (NUC-sized) mini PCs have pins for discrete TPM.
yencabulator 2y ago
Generally the other way, if you're paranoid -- the fact that it's separate component allows an attacker to MITM the communication.

c0l0 2y ago

Not according to the spec sheet or the PCB photos[0][1] they provide, no. [0]: https://www.asrock.com/nettop/photo/DeskMeet%20X600%20Series(L5).png https://www.asrock.com/nettop/photo/DeskMeet%20X600%20Series... [1]: https://www.asrock.com/nettop/photo/DeskMeet%20X600%20Series(L6).png https://www.asrock.com/nettop/photo/DeskMeet%20X600%20Series...