8 ms·

TPM provides zero practical security

76 points by osy 3y ago

pxeger1 3y ago
I don't agree with this. Yes, any TPM is necessarily possible to bypass, but it's not easy. I know I could bypass normal password-based FDE with physical access to a machine without any special hardware or software, but not TPM-based. I assume, by the Pareto principle, that there are lots of people with my ability but exponentially fewer who could bypass a TPM. So it's definitely more secure than password-based FDE, and it's good enough for me.
- missingrib 3y ago
  >I know I could bypass normal password-based FDE with physical access to a machine without any special hardware or software How?
  - pxeger1 3y ago
    Change the bootloader and /bin/init so that it captures the disk encryption password as you enter it. It could then send it to me, or add a second password that I know so that I can decrypt it with later physical access. Actually, on second thought, it's secure boot that protects against this attack, which doesn't require or use a TPM? So maybe I'm wrong
ak217 3y ago
> You can also use the TPM + PIN as a sort of Yubikey That's not zero. In my mind that's the main thing a TPM is really useful for. It's a secure enclave for a private key used for U2F/WebAuthn style attestation. I agree that the threat model not being explicitly discussed is a huge miss. But to that point, a TPM is still useful because it prevents someone who has hacked into my computer from commanding the TPM's authentication factor. The other useful application is to prevent block device data extraction without knowing the passkey. And the author's argument there hinges on the notion that Microsoft won't patch OS security vulnerabilities that enable key extraction from memory. Which, OK, third-party drivers suck, but Microsoft's effort to patch is also not zero, and the most common (OS+browser/sandbox) threat model requires a chain of vulnerabilities that are hard to come by.
- deleted 3y ago
  [deleted]
- osy 3y ago
  This is not the way TPMs are used by most of the industry. For example, Microsoft and now Canonical are advertising it as a way to do FDE which Microsoft has known to be broken since 2006. They are requiring it for Windows 11 because of "security" and have provided no software feature on Windows for this kind of use case. It is only done by the OSS community. > The other useful application is to prevent block device data extraction without knowing the passkey. Nope, read the appendix. Since 2006, BitLocker without PIN is vulnerable to physical extraction with $80 worth of equipment. And to enable enhanced PIN for BitLocker you have to jump to a lot of hoops that most people don't even know about.
  - lxgr 3y ago
    > This is not the way TPMs are used by most of the industry. [...] It is only done by the OSS community. So some industry stakeholders are doing bad things with an inherently neutral technology. Does that mean we need to get rid of the entire thing, thereby also killing the OSS use cases? Yes, trusted computing can be used in user-hostile ways, but the solution here seems to be to not use OSes and applications using it in that way, rather than throwing out the technology as a whole.
    - AnthonyMouse 3y ago
      The trouble is we keep conflating two different things. Something that works like a hardware security module, where it stores your keys and tries to restrict who can access them, has some potential uses. The keys are only in your own device, so someone can't break an entirely different device or a centralized single point of failure to get access. And this can't be used against the user because both the device and the key itself are still fully in their control -- they could put a key in the HSM and still have a copy of it somewhere else to use however they like. Whereas anything that comes with a vendor's keys installed in it from the factory is both malicious and snake oil. Malicious because it causes the user's device to defect against them and some users aren't sophisticated enough to understand this or bypass it even if malicious attackers can, and snake oil because you can't rely on something for actual security if a break of any device by anyone anywhere could forge attestations, since that is extremely likely to happen and has a long history of doing so.
marcosdumay 3y ago
On the one usage scenario that benefits a PC user, the TPM makes for a really bad yubikey. You can't carry it between computers, you can't back it up, and you are certain to lose it at some point when the computer breaks of gets outdated. That means it either requires a second protocol for authentication, or that you will lose your accounts with all kinds of services all the time.
- josteink 3y ago
  > the TPM makes for a really bad yubikey. You can't … you can't back it up Technically speaking, the exact same restrictions apply to a Yubikey. That’s what makes it secure.
- mgbmtl 3y ago
  Depends on the implementation? For many services, I register my Yubikey, but also the Android fingerprint authentication (as well as TOTP as another fallback). So for example, if I login to Gitlab on my phone, I can use my fingerprint (lockscreen auth). It's more convenient than using the TOTP app. Similarly, I could register a TPM from my desktop that could be the same as using the fingerprint auth? It would only work from that desktop, but it's the same logic as my phone, and in a sense, that's a nice benefit.
  - donmcronald 3y ago
    Every fallback method adds risk. Realistically though, I don't think any of it really matters. By far the weakest link everywhere is SMS/Email based account recovery and it's almost impossible to avoid those. Sometimes I think the average person would be better of with a highly secured email account and magic links for everything else. Even for me, I have YubiKeys, TPMs, etc. configured for everything, but if I forget to lock my laptop and someone walks off with it, they have access to my email which is basically my entire digital life due to account recovery via email.
- Nextgrid 3y ago
  The TPM covers cases where you want to authenticate the machine, not the user (who'd have a Yubikey they'd carry with them between machines). There are plenty of valid use-cases where you'd want the machine to authenticate itself to services (VPN to enterprise network?) before anyone logs in (or ever logs in, as in the case of servers who operate unattended).
awesomeMilou 3y ago
At this point I don't understand why hardware vendors can't just do it like Apple. Put a small ARM SoC with some firmware in ROM onto the mainboard that starts before the main CPU and initializes it, ensuring that the system is in a known state before any components boot.
- mschuster91 3y ago
  That's actually how modern Intel and AMD CPUs work.
  - g_p 3y ago
    Indeed, and TPM + secure boot broadly define how these built-in firmware TPMs (fTPMs) implement verification and validation of system components. TPM is the specification and standard for a predictable way this is implemented, and most modern CPUs do this as you say, with option ROM validation, UEFI firmware integrity checking, etc.
  - awesomeMilou 3y ago
    The author claims that this is not the case: > Note that at any point in this process, if the attacker is able to control code execution, there is no way for TPM to know that the measurement it was just handed wasn't a lie. Now let's assume you are an attacker trying to get the BitLocker keys, what can you do? [0] [0] https://gist.github.com/osy/45e612345376a65c56d0678834535166#where-does-it-break https://gist.github.com/osy/45e612345376a65c56d0678834535166...
- deleted 3y ago
  [deleted]
sidewndr46 3y ago
well sure, TPM is mostly about limiting what the average Joe can run on his computer. It isn't meant to stop adversaries.
- avery17 3y ago
  Its just more garbage DRM. Its Sony telling you that you don't own your PS3 all over again except it's the PC you built and Microsoft telling you what you can and can't do with it. Try to crack your CPU key to fake the TPM and Microsoft will sue you out of existance just like Sony did with Geohotz. Thanks to the DMCA and it's anti-circumvention laws, we no longer own any hardware, we're just borrowing it.
hirsin 3y ago
So it boils down to "we shouldn't attempt to build new security stuff because what it's built on could have vulnerabilities"? Time to go back to kernel mode everything I guess. Just run everything as root, get rid of sudo.
- stonogo 3y ago
  There's an argument to be made that security vulnerabilities the user can't fix are worse than ones they can, but this article doesn't make it.
- deciduously 3y ago
  Ring-0 only, and 640x480 as God intended.
  - glonq 3y ago
    That's why I use TempleOS exclusively.
- osy 3y ago
  The exact argument was made in the article > There are a plethora of attacks on TPM in the past but we need to be clear that a system that is widely attacked does not necessarily mean it is fundamentally insecure but only that there are many implementation issues. Most of these implementation issues do not touch upon the points raised in this article (it doesn't matter if the gate to your garden is strong or weak if there is no fence around the garden). Nevertheless, many of the attacks demonstrate the lack of care and consideration in the TPM ecosystem. The issue is that TPM is being heavily pushed while it provides no security value. When you have Secure Boot (no additional hardware required), you get everything that Microsoft promises. The entire idea of TPM is that it gives you an extra level of security and I argue that it doesn't.
completelylegit 3y ago
TPM isn’t about security, it’s about DRM
- etna_ramequin 3y ago
  I’ve seen many widely deployed applications of TPM for security, never for DRM.
  - sudosysgen 3y ago
    You've never used Widevine? If you ever tried to use a streaming website, you almost certainly did. EDIT: To clarify, Widevine doesn't actually use the TPM, but Widevine L2 uses a TEE for key exchange and decryption, which are all things that modern TPMs support. The use a crypto coprocessor for key exchange and decryption is widely used.
    - lxgr 3y ago
      Are you sure Widevine uses the attestation functionalities of a TPM on Windows? I thought Widevine on computers (whether Windows, macOS or Linux) is always L3, i.e. software only, and L1 needs a TEE on Android or an embedded OS such as on a set top box or streaming dongle.
      - sudosysgen 3y ago
        Indeed, it doesn't use it on Windows. Widevine L2 however uses the TEE in exactly the same way as a TPM is used, for attestation and for cryptography (you can do AES decryption using a TPM).
        lxgr 3y ago
        A TPM isn't the same thing as a TEE at all. You can't run copy protection logic in a TPM, for example. The two are complementary, though: A TEE can run "trusted" logic, such as DRM decryption code, and you can use a TPM-like device to hold the attestation keys and measurement funcitonalities for the TEE. I'm saying "TPM-like" because some TEEs have their own proprietary or embedded secure elements and don't need a TPM proper. (I'm actually not sure if TPMs are "TEE-aware", which would be required to e.g. only let some keys be used from the secure context, as otherwise storing DRM keys in the generally-accessible portion defeats the purpose.) Without a TEE (and a TPM itself does not imply one on x86), what you can do is declare your entire system a TEE, and then use the TPMs measurements as an assertion over that system's untampered state. This is pretty infeasible to do securely though, given the size of the codebase of most OSes, which is why the "DRM in TEE" approach is much more common. That's what Android does, for example.
donmcronald 3y ago
> the signature of the BIOS is checked against a public key whose hash is stored in fuses > Each of dozens (up to hundreds) of UEFI drivers written by various OEMs with varying levels of competence and care are loaded Doesn't the BIOS signature encompass those drivers? Put another way, isn't the BIOS vendor attesting those drivers are non-malicious with their signature? I think the TPM will turn out to be a net negative for consumers since it's going to get used to get used for attestations users can't control (ie: against the will of the user), but there are some benefits. Having a BitLocker key unlocked via a PIN where the TPM can protect against brute force attacks is useful for me. That alone covers most of my threat model which is having my data extracted from a lost or stolen PC.
Nextgrid 3y ago
Unfortunately this sounds like a typical pro-Linux rant with the usual scare words such as "Microsoft", "UEFI", "secure boot", etc. To be clear, I am attacking the piece itself, not the author. The reason there is no explicit threat model defined in the TPM specs is because it defines a general-purpose hardware security module. It is up to integrator to define the threat model (TPM's security properties also depend on the rest of the system) and the application. Even if a TPM is not perfect and depends on other pieces of the puzzle to also be secure, it at least opens the possibility of making it secure in the future once those vulnerabilities are discovered & fixed. Furthermore, even in this vulnerable state, it still increases the effort required for a successful attack. Support for TPM-backed full disk encryption means you can now have FDE on by default for everyone with no usability impact at all. Even if it's not secure and a dedicated attack will still break it, it means a casual attacker can't just pull a drive or reboot the machine and run chntpw or steal sensitive data from discarded drives that haven't been properly wiped. I like TPMs. I like the fact that a rogue datacenter employee or intruder can't just pull one of my servers' drives out and get sensitive data. I like not having to worry about having sensitive keys on the filesystem somewhere because every secret is in memory and is ultimately derived from the TPM doing remote attestation at boot and handing ephemeral keys. I like not having to worry about unattended reboots or entering LUKS passphrases remotely.
- cm2187 3y ago
  Likewise, I am not too concerned about the NSA breaking into my laptop. I just want that if some kid finds it and tries to plug the SSD into his computer, my files aren't all there to be read.
- candiddevmike 3y ago
  What's the point of TPM-backed full disk encryption with no usability impact (meaning password/pin-less) for the average user who is more likely to get their device stolen vs some covert disk image shenanigan?
  - Nextgrid 3y ago
    If the device is stolen it can still enforce OS-level authentication (including potentially phoning home, invalidating its access to remote resources, or erasing itself), except now you can't bypass it by rebooting and running chntpw. Will this stop a dedicated attacker? Probably not, although a fTPM with an up to date OS would require the attacker to find an exploit for this machine's early boot firmware (UEFI, etc) or burn a Windows zero-day, both of which are very costly. It does however prevent your casual thief from watching a YT video "how to reset windows password using linux live cd" and then getting access to your sensitive data (browser's saved passwords, etc), so it's a major improvement.
WirelessGigabit 3y ago
All the hardware based attacks require opening up the laptop and doing something with the motherboard. I'd have to check if bottom cover tampering on my Lenovo actually requires me to put in the BitLocker keys again.
helloooooooo 3y ago
Ask Google exactly how they enforce their zero trust, VPN-less remote work environment. Hint: it has to do with the TPM. DRTM + Device Certificates + TLS Token Binding is a huge deal for proving that the endpoint is trusted, and that the principal actually logging in is using an approved device. DRTM prevents boot time tampering by assuring that the measured boot state is consistent with what the network expects.
- osy 3y ago
  Yes, when implemented correctly (I've never seen Google's implementation so I can't comment), D-RTM + Secure Boot is good. If Microsoft would give us this before shoving TPM down our throats, it would be good :) But they haven't even fixed the weaknesses they identified on their own in 2006.
  - als0 3y ago
    > D-RTM + Secure Boot is good. If Microsoft would give us this before shoving TPM down our throats, it would be good D-RTM requires TPM.
- saagarjha 3y ago
  None of my machines when I was at Google implemented this. The attestation was a bunch of scripts running on my computer that cobbled together the output of various things they cared to validate.
PeterStuer 3y ago
Wouldn't the threath mitigation model be "prevent 80% of normies watching Disney on their HDMI monitor without paying"?
- stonogo 3y ago
  The threat model is "corporation wants hardware attestation so they can implement zero-trust models" but these articles always ignore that, because they don't have any alternatives to suggest.
predictabl3 3y ago
The absolute dumbest shit here gets up voted regarding Linux. No dang, I don't care about the spirit of the site when absolute ludicrous mindrot garbage is up voted here constantly. You'll note on the Wayland thread that, despite being the 30th Wayland thread, the only substantive reply agreed with me. It's a joke. Don't worry, I'm changing my password to a random guid, you'll be free of me in 45 seconds.
decodebytes 3y ago
A lot of this is plain naive and wrong.
- saagarjha 3y ago
  How so?
yakkityyak 3y ago
Zero is a stretch. I think they have largely failed to serve their purpose in the consumer device realm, beyond decent integration with BitLocker. Despite the shortcomings, I think they are very useful devices from the perspective of running data centers. I consider it useless against evil maid attacks though.
- Nextgrid 3y ago
  I think they failed to serve their purpose because until relatively recently they've only been present on premium-grade machines, so software couldn't rely on the presence of one. Nowadays with Microsoft making it a requirement (as well as fTPM which means the TPM no longer requires dedicated hardware) we might see more use-cases.
- lostmsu 3y ago
  I feel like BitLocker is a great feature. So great it's one of the few things keeping me on Windows. Would not call it "largely failed".
lxgr 3y ago
Should the title at least be "the trusted computing/measurement functionality of TPMs provide..." rather than "TPM provides..."? TPMs can do other useful things besides performing attestation measurements for trusted computing, including acting as a secure element to safeguard and rate-limit keys used for SSH, disk encryption and much more.
mixmastamyk 3y ago
Been wondering if I should enable these things in the firmware for several years, so the discussion is welcomed. I do have a travel laptop and recently installed LUKS to it. I like having my long password, but being able to tie unlocking to the hardware sounds like a good idea too. Is there a way to have both? A long password and require the local TPM?
- als0 3y ago
  Yes you can set up your LUKS to require both. Have a look at systemd-cryptenroll.
EPWN3D 3y ago
Not a great take. The TPM provides the primitive of "non-extractable keys"; it's not supposed to magic up secure boot. Even then, the argument that a TPM is worthless because it can't guarantee that software is free of vulnerabilities just belies an un-seriousness of the post. Like okay, that argument applies to every threat model ever. A boot chain can be secure with or without a TPM. The TPM just says "I'll record what your boot chain told me and spit it back out with a signature that is verifiable by public key cryptography, so that you can tell it's what your boot chain told me. How much you trust your boot chain is up to you."
- saagarjha 3y ago
  TPM relies on every link in the chain up to your OS being free of vulnerabilities. If any part has a bug, then the TPM is broken. For this kind of model, why not just put the data in one of those layers then? You've said that it's secure already. (Most other threat models go "ok we trust some part of this is secure, and that means we can guarantee x, y, z; if that part is not secure then we cannot do this.)
TowerTall 3y ago
> The Trusted Platform Module(TPM) requirement enables Windows 11 to be a true Passwordless operating system Good luck trying to remote (RDP) into a Windows box with a passwordless account or to access a fileshare. While passwordless Microsoft accounts are very convenient it is only according to MS Marketing department that windows can be a true passwordless system. In reality it is not. There any several components in Windows that does not work with a passwordless account. The RDP and network issues has been know for many years and is a PITA for home networking.

76 points by osy 3y ago

I don't agree with this. Yes, any TPM is necessarily possible to bypass, but it's not easy. I know I could bypass normal password-based FDE with physical access to a machine without any special hardware or software, but not TPM-based. I assume, by the Pareto principle, that there are lots of people with my ability but exponentially fewer who could bypass a TPM. So it's definitely more secure than password-based FDE, and it's good enough for me.

missingrib 3y ago
>I know I could bypass normal password-based FDE with physical access to a machine without any special hardware or software How?
- pxeger1 3y ago
  Change the bootloader and /bin/init so that it captures the disk encryption password as you enter it. It could then send it to me, or add a second password that I know so that I can decrypt it with later physical access. Actually, on second thought, it's secure boot that protects against this attack, which doesn't require or use a TPM? So maybe I'm wrong

ak217 3y ago

> You can also use the TPM + PIN as a sort of Yubikey That's not zero. In my mind that's the main thing a TPM is really useful for. It's a secure enclave for a private key used for U2F/WebAuthn style attestation. I agree that the threat model not being explicitly discussed is a huge miss. But to that point, a TPM is still useful because it prevents someone who has hacked into my computer from commanding the TPM's authentication factor. The other useful application is to prevent block device data extraction without knowing the passkey. And the author's argument there hinges on the notion that Microsoft won't patch OS security vulnerabilities that enable key extraction from memory. Which, OK, third-party drivers suck, but Microsoft's effort to patch is also not zero, and the most common (OS+browser/sandbox) threat model requires a chain of vulnerabilities that are hard to come by.

deleted 3y ago
[deleted]
osy 3y ago
This is not the way TPMs are used by most of the industry. For example, Microsoft and now Canonical are advertising it as a way to do FDE which Microsoft has known to be broken since 2006. They are requiring it for Windows 11 because of "security" and have provided no software feature on Windows for this kind of use case. It is only done by the OSS community. > The other useful application is to prevent block device data extraction without knowing the passkey. Nope, read the appendix. Since 2006, BitLocker without PIN is vulnerable to physical extraction with $80 worth of equipment. And to enable enhanced PIN for BitLocker you have to jump to a lot of hoops that most people don't even know about.
- lxgr 3y ago
  > This is not the way TPMs are used by most of the industry. [...] It is only done by the OSS community. So some industry stakeholders are doing bad things with an inherently neutral technology. Does that mean we need to get rid of the entire thing, thereby also killing the OSS use cases? Yes, trusted computing can be used in user-hostile ways, but the solution here seems to be to not use OSes and applications using it in that way, rather than throwing out the technology as a whole.
  - AnthonyMouse 3y ago
    The trouble is we keep conflating two different things. Something that works like a hardware security module, where it stores your keys and tries to restrict who can access them, has some potential uses. The keys are only in your own device, so someone can't break an entirely different device or a centralized single point of failure to get access. And this can't be used against the user because both the device and the key itself are still fully in their control -- they could put a key in the HSM and still have a copy of it somewhere else to use however they like. Whereas anything that comes with a vendor's keys installed in it from the factory is both malicious and snake oil. Malicious because it causes the user's device to defect against them and some users aren't sophisticated enough to understand this or bypass it even if malicious attackers can, and snake oil because you can't rely on something for actual security if a break of any device by anyone anywhere could forge attestations, since that is extremely likely to happen and has a long history of doing so.

marcosdumay 3y ago

On the one usage scenario that benefits a PC user, the TPM makes for a really bad yubikey. You can't carry it between computers, you can't back it up, and you are certain to lose it at some point when the computer breaks of gets outdated. That means it either requires a second protocol for authentication, or that you will lose your accounts with all kinds of services all the time.

josteink 3y ago
> the TPM makes for a really bad yubikey. You can't … you can't back it up Technically speaking, the exact same restrictions apply to a Yubikey. That’s what makes it secure.
mgbmtl 3y ago
Depends on the implementation? For many services, I register my Yubikey, but also the Android fingerprint authentication (as well as TOTP as another fallback). So for example, if I login to Gitlab on my phone, I can use my fingerprint (lockscreen auth). It's more convenient than using the TOTP app. Similarly, I could register a TPM from my desktop that could be the same as using the fingerprint auth? It would only work from that desktop, but it's the same logic as my phone, and in a sense, that's a nice benefit.
- donmcronald 3y ago
  Every fallback method adds risk. Realistically though, I don't think any of it really matters. By far the weakest link everywhere is SMS/Email based account recovery and it's almost impossible to avoid those. Sometimes I think the average person would be better of with a highly secured email account and magic links for everything else. Even for me, I have YubiKeys, TPMs, etc. configured for everything, but if I forget to lock my laptop and someone walks off with it, they have access to my email which is basically my entire digital life due to account recovery via email.
Nextgrid 3y ago
The TPM covers cases where you want to authenticate the machine, not the user (who'd have a Yubikey they'd carry with them between machines). There are plenty of valid use-cases where you'd want the machine to authenticate itself to services (VPN to enterprise network?) before anyone logs in (or ever logs in, as in the case of servers who operate unattended).

awesomeMilou 3y ago

At this point I don't understand why hardware vendors can't just do it like Apple. Put a small ARM SoC with some firmware in ROM onto the mainboard that starts before the main CPU and initializes it, ensuring that the system is in a known state before any components boot.

mschuster91 3y ago
That's actually how modern Intel and AMD CPUs work.
- g_p 3y ago
  Indeed, and TPM + secure boot broadly define how these built-in firmware TPMs (fTPMs) implement verification and validation of system components. TPM is the specification and standard for a predictable way this is implemented, and most modern CPUs do this as you say, with option ROM validation, UEFI firmware integrity checking, etc.
- awesomeMilou 3y ago
  The author claims that this is not the case: > Note that at any point in this process, if the attacker is able to control code execution, there is no way for TPM to know that the measurement it was just handed wasn't a lie. Now let's assume you are an attacker trying to get the BitLocker keys, what can you do? [0] [0] https://gist.github.com/osy/45e612345376a65c56d0678834535166#where-does-it-break https://gist.github.com/osy/45e612345376a65c56d0678834535166...
deleted 3y ago
[deleted]

sidewndr46 3y ago

well sure, TPM is mostly about limiting what the average Joe can run on his computer. It isn't meant to stop adversaries.

avery17 3y ago
Its just more garbage DRM. Its Sony telling you that you don't own your PS3 all over again except it's the PC you built and Microsoft telling you what you can and can't do with it. Try to crack your CPU key to fake the TPM and Microsoft will sue you out of existance just like Sony did with Geohotz. Thanks to the DMCA and it's anti-circumvention laws, we no longer own any hardware, we're just borrowing it.

hirsin 3y ago

So it boils down to "we shouldn't attempt to build new security stuff because what it's built on could have vulnerabilities"? Time to go back to kernel mode everything I guess. Just run everything as root, get rid of sudo.

stonogo 3y ago
There's an argument to be made that security vulnerabilities the user can't fix are worse than ones they can, but this article doesn't make it.
deciduously 3y ago
Ring-0 only, and 640x480 as God intended.
- glonq 3y ago
  That's why I use TempleOS exclusively.
osy 3y ago
The exact argument was made in the article > There are a plethora of attacks on TPM in the past but we need to be clear that a system that is widely attacked does not necessarily mean it is fundamentally insecure but only that there are many implementation issues. Most of these implementation issues do not touch upon the points raised in this article (it doesn't matter if the gate to your garden is strong or weak if there is no fence around the garden). Nevertheless, many of the attacks demonstrate the lack of care and consideration in the TPM ecosystem. The issue is that TPM is being heavily pushed while it provides no security value. When you have Secure Boot (no additional hardware required), you get everything that Microsoft promises. The entire idea of TPM is that it gives you an extra level of security and I argue that it doesn't.

completelylegit 3y ago

TPM isn’t about security, it’s about DRM

etna_ramequin 3y ago
I’ve seen many widely deployed applications of TPM for security, never for DRM.
- sudosysgen 3y ago
  You've never used Widevine? If you ever tried to use a streaming website, you almost certainly did. EDIT: To clarify, Widevine doesn't actually use the TPM, but Widevine L2 uses a TEE for key exchange and decryption, which are all things that modern TPMs support. The use a crypto coprocessor for key exchange and decryption is widely used.
  - lxgr 3y ago
    Are you sure Widevine uses the attestation functionalities of a TPM on Windows? I thought Widevine on computers (whether Windows, macOS or Linux) is always L3, i.e. software only, and L1 needs a TEE on Android or an embedded OS such as on a set top box or streaming dongle.
    - sudosysgen 3y ago
      Indeed, it doesn't use it on Windows. Widevine L2 however uses the TEE in exactly the same way as a TPM is used, for attestation and for cryptography (you can do AES decryption using a TPM).
      - lxgr 3y ago
        A TPM isn't the same thing as a TEE at all. You can't run copy protection logic in a TPM, for example. The two are complementary, though: A TEE can run "trusted" logic, such as DRM decryption code, and you can use a TPM-like device to hold the attestation keys and measurement funcitonalities for the TEE. I'm saying "TPM-like" because some TEEs have their own proprietary or embedded secure elements and don't need a TPM proper. (I'm actually not sure if TPMs are "TEE-aware", which would be required to e.g. only let some keys be used from the secure context, as otherwise storing DRM keys in the generally-accessible portion defeats the purpose.) Without a TEE (and a TPM itself does not imply one on x86), what you can do is declare your entire system a TEE, and then use the TPMs measurements as an assertion over that system's untampered state. This is pretty infeasible to do securely though, given the size of the codebase of most OSes, which is why the "DRM in TEE" approach is much more common. That's what Android does, for example.

donmcronald 3y ago

> the signature of the BIOS is checked against a public key whose hash is stored in fuses > Each of dozens (up to hundreds) of UEFI drivers written by various OEMs with varying levels of competence and care are loaded Doesn't the BIOS signature encompass those drivers? Put another way, isn't the BIOS vendor attesting those drivers are non-malicious with their signature? I think the TPM will turn out to be a net negative for consumers since it's going to get used to get used for attestations users can't control (ie: against the will of the user), but there are some benefits. Having a BitLocker key unlocked via a PIN where the TPM can protect against brute force attacks is useful for me. That alone covers most of my threat model which is having my data extracted from a lost or stolen PC.

Nextgrid 3y ago

Unfortunately this sounds like a typical pro-Linux rant with the usual scare words such as "Microsoft", "UEFI", "secure boot", etc. To be clear, I am attacking the piece itself, not the author. The reason there is no explicit threat model defined in the TPM specs is because it defines a general-purpose hardware security module. It is up to integrator to define the threat model (TPM's security properties also depend on the rest of the system) and the application. Even if a TPM is not perfect and depends on other pieces of the puzzle to also be secure, it at least opens the possibility of making it secure in the future once those vulnerabilities are discovered & fixed. Furthermore, even in this vulnerable state, it still increases the effort required for a successful attack. Support for TPM-backed full disk encryption means you can now have FDE on by default for everyone with no usability impact at all. Even if it's not secure and a dedicated attack will still break it, it means a casual attacker can't just pull a drive or reboot the machine and run chntpw or steal sensitive data from discarded drives that haven't been properly wiped. I like TPMs. I like the fact that a rogue datacenter employee or intruder can't just pull one of my servers' drives out and get sensitive data. I like not having to worry about having sensitive keys on the filesystem somewhere because every secret is in memory and is ultimately derived from the TPM doing remote attestation at boot and handing ephemeral keys. I like not having to worry about unattended reboots or entering LUKS passphrases remotely.

cm2187 3y ago
Likewise, I am not too concerned about the NSA breaking into my laptop. I just want that if some kid finds it and tries to plug the SSD into his computer, my files aren't all there to be read.
candiddevmike 3y ago
What's the point of TPM-backed full disk encryption with no usability impact (meaning password/pin-less) for the average user who is more likely to get their device stolen vs some covert disk image shenanigan?
- Nextgrid 3y ago
  If the device is stolen it can still enforce OS-level authentication (including potentially phoning home, invalidating its access to remote resources, or erasing itself), except now you can't bypass it by rebooting and running chntpw. Will this stop a dedicated attacker? Probably not, although a fTPM with an up to date OS would require the attacker to find an exploit for this machine's early boot firmware (UEFI, etc) or burn a Windows zero-day, both of which are very costly. It does however prevent your casual thief from watching a YT video "how to reset windows password using linux live cd" and then getting access to your sensitive data (browser's saved passwords, etc), so it's a major improvement.

WirelessGigabit 3y ago

All the hardware based attacks require opening up the laptop and doing something with the motherboard. I'd have to check if bottom cover tampering on my Lenovo actually requires me to put in the BitLocker keys again.

helloooooooo 3y ago

Ask Google exactly how they enforce their zero trust, VPN-less remote work environment. Hint: it has to do with the TPM. DRTM + Device Certificates + TLS Token Binding is a huge deal for proving that the endpoint is trusted, and that the principal actually logging in is using an approved device. DRTM prevents boot time tampering by assuring that the measured boot state is consistent with what the network expects.

osy 3y ago
Yes, when implemented correctly (I've never seen Google's implementation so I can't comment), D-RTM + Secure Boot is good. If Microsoft would give us this before shoving TPM down our throats, it would be good :) But they haven't even fixed the weaknesses they identified on their own in 2006.
- als0 3y ago
  > D-RTM + Secure Boot is good. If Microsoft would give us this before shoving TPM down our throats, it would be good D-RTM requires TPM.
saagarjha 3y ago
None of my machines when I was at Google implemented this. The attestation was a bunch of scripts running on my computer that cobbled together the output of various things they cared to validate.

PeterStuer 3y ago

Wouldn't the threath mitigation model be "prevent 80% of normies watching Disney on their HDMI monitor without paying"?

stonogo 3y ago
The threat model is "corporation wants hardware attestation so they can implement zero-trust models" but these articles always ignore that, because they don't have any alternatives to suggest.

predictabl3 3y ago

The absolute dumbest shit here gets up voted regarding Linux. No dang, I don't care about the spirit of the site when absolute ludicrous mindrot garbage is up voted here constantly. You'll note on the Wayland thread that, despite being the 30th Wayland thread, the only substantive reply agreed with me. It's a joke. Don't worry, I'm changing my password to a random guid, you'll be free of me in 45 seconds.

decodebytes 3y ago

A lot of this is plain naive and wrong.

saagarjha 3y ago
How so?

yakkityyak 3y ago

Zero is a stretch. I think they have largely failed to serve their purpose in the consumer device realm, beyond decent integration with BitLocker. Despite the shortcomings, I think they are very useful devices from the perspective of running data centers. I consider it useless against evil maid attacks though.

Nextgrid 3y ago
I think they failed to serve their purpose because until relatively recently they've only been present on premium-grade machines, so software couldn't rely on the presence of one. Nowadays with Microsoft making it a requirement (as well as fTPM which means the TPM no longer requires dedicated hardware) we might see more use-cases.
lostmsu 3y ago
I feel like BitLocker is a great feature. So great it's one of the few things keeping me on Windows. Would not call it "largely failed".

lxgr 3y ago

Should the title at least be "the trusted computing/measurement functionality of TPMs provide..." rather than "TPM provides..."? TPMs can do other useful things besides performing attestation measurements for trusted computing, including acting as a secure element to safeguard and rate-limit keys used for SSH, disk encryption and much more.

mixmastamyk 3y ago

Been wondering if I should enable these things in the firmware for several years, so the discussion is welcomed. I do have a travel laptop and recently installed LUKS to it. I like having my long password, but being able to tie unlocking to the hardware sounds like a good idea too. Is there a way to have both? A long password and require the local TPM?

als0 3y ago
Yes you can set up your LUKS to require both. Have a look at systemd-cryptenroll.

EPWN3D 3y ago

Not a great take. The TPM provides the primitive of "non-extractable keys"; it's not supposed to magic up secure boot. Even then, the argument that a TPM is worthless because it can't guarantee that software is free of vulnerabilities just belies an un-seriousness of the post. Like okay, that argument applies to every threat model ever. A boot chain can be secure with or without a TPM. The TPM just says "I'll record what your boot chain told me and spit it back out with a signature that is verifiable by public key cryptography, so that you can tell it's what your boot chain told me. How much you trust your boot chain is up to you."

saagarjha 3y ago
TPM relies on every link in the chain up to your OS being free of vulnerabilities. If any part has a bug, then the TPM is broken. For this kind of model, why not just put the data in one of those layers then? You've said that it's secure already. (Most other threat models go "ok we trust some part of this is secure, and that means we can guarantee x, y, z; if that part is not secure then we cannot do this.)

TowerTall 3y ago

> The Trusted Platform Module(TPM) requirement enables Windows 11 to be a true Passwordless operating system Good luck trying to remote (RDP) into a Windows box with a passwordless account or to access a fileshare. While passwordless Microsoft accounts are very convenient it is only according to MS Marketing department that windows can be a true passwordless system. In reality it is not. There any several components in Windows that does not work with a passwordless account. The RDP and network issues has been know for many years and is a PITA for home networking.