4 ms·

You need the TPM to bootstrap trust from the root. Just as you need a certificate authority to guarantee that an SSH session is end-to-end secure from MITM atta

You need the TPM to bootstrap trust from the root. Just as you need a certificate authority to guarantee that an SSH session is end-to-end secure from MITM attacks (or some other out-of-band key signing scheme), you need a way to ensure that the Ironclad system you're talking to over the network is running on the raw hardware, and not in some emulated form. The TPM boot is what lets you do that. Ironclad Apps make promises like "send us your private data, we promise not to reveal anything about you except through this information theoretically secure differentially private channel". To do so it needs to be running on bare metal, and prove over the network to the user that it is running on bare metal. For instance if it was really running in a VM controlled by an adversary, then the guarantees would be useless as the adversary could leak your information after inspecting the VM's memory. The only way to ensure that you're running on bare metal is with a TPM attestation.

wmf 12y ago
I thought higherpurpose was asking why PCs need remote attestation instead of local attestation or sealing.
kefka 12y ago
>The TPM boot is what lets you do that. Fine. Where can I go download my TPM key? Perhaps it is etched on the chip or on a sticker? Nope? What do you mean it's kept from me? Hmm.
- drdaeman 12y ago
  You can upload one, but not download, since TPM's very purpose is to take hold of the key and never disclose it. Well, not sure if that's true for any module, but this is how it worked on my old ThinkPad X300 (I have no other machines with TPM, they're restricted technology here in Russia, no idea how my X300 had slipped through) No idea how one's initialized at factory. However, I'm totally fine with TPM if I can control one, that is upload my own keys and use it for my own security. Still, there's an issue lurking around, if everyone's got a factory-initialized module with industry's trusted keys and the majority keeps those defaults, users who don't trust may be a minority that will be just ignored thus either left without any entertainment of forced to submit.

wmf 12y ago

I thought higherpurpose was asking why PCs need remote attestation instead of local attestation or sealing.

kefka 12y ago

>The TPM boot is what lets you do that. Fine. Where can I go download my TPM key? Perhaps it is etched on the chip or on a sticker? Nope? What do you mean it's kept from me? Hmm.

drdaeman 12y ago
You can upload one, but not download, since TPM's very purpose is to take hold of the key and never disclose it. Well, not sure if that's true for any module, but this is how it worked on my old ThinkPad X300 (I have no other machines with TPM, they're restricted technology here in Russia, no idea how my X300 had slipped through) No idea how one's initialized at factory. However, I'm totally fine with TPM if I can control one, that is upload my own keys and use it for my own security. Still, there's an issue lurking around, if everyone's got a factory-initialized module with industry's trusted keys and the majority keeps those defaults, users who don't trust may be a minority that will be just ignored thus either left without any entertainment of forced to submit.