5 ms·

There are none. It's so immensely frustrating to me that so many people believe that a TPM is a DRM device. I'm sure Richard Stallman's Treacherous Computing ar

by mkopec 2y ago

There are none. It's so immensely frustrating to me that so many people believe that a TPM is a DRM device. I'm sure Richard Stallman's Treacherous Computing article played a big part in this. A TPM is useless for DRM, and there are way more suited solutions like Intel's PAVP that takes an encrypted video stream and puts it on the screen directly, yet I don't see nearly as much uproar about that.

zinekeller 2y ago
In a sense, graphics cards are the root-of-trust for PC-based DRMs (as they implement the necessary components such as HDCP authentication), not the TPM (which is useless for this task). In fact, PlayReady (which is Microsoft's DRM solution) does this exact thing: https://learn.microsoft.com/en-us/windows/uwp/audio-video-camera/hardware-drm#:~:text=Windows%20implements%20the%20OEM%20proxy%20layer%20and%20transfers%20the%20serialized%20PRITEE%20functions%20calls%20to%20a%20user%20mode%20driver%20in%20the%20Windows%20Media%20Foundation%20subsystem.%20This%20will%20eventually%20get%20routed%20to%20either%20the%20Windows%20TrEE%20(Trusted%20Execution%20Environment)%20driver%20or%20the%20OEM%E2%80%99s%20graphics%20driver. https://learn.microsoft.com/en-us/windows/uwp/audio-video-ca... (...or use things such as the already-dead Intel SGX, which never touched TPMs at all)
deno 2y ago
It goes TPM → OS Integrity (dm-/fs-verity) → Browser Attestation (Web Integrity) → Your banking website no longer working on Linux because of "security". It’s Play Integrity for the PC. Encrypted video is a red herring. The real long game is to also get your "secure" video player to refuse playback if it detects watermark in the pirated video. This patches the analog hole. If you have attested Windows it can just refuse to download "freeworld" VLC because it can be used for piracy and/or even watching child pornography. Imagine that! Of course you can use Linux instead but now you have to use the approved distro that also won’t let you run "dangerous" apps. This is of course slippery slope argument and Microsoft would not be able to force all that right now, but better get started on the foundations. Some future government can then just force them to implement the rest, but by then it will be just a flip of a switch. "TPM is not DRM" argument seriously lacks imagination.
- mkopec 2y ago
  Google SafetyNet is basically swiss cheese with lots of bypass solutions for custom ROMs. A TPM may only attest that it has received an expected set of measurements (hashes). As long as discrete TPMs or PCs with unlocked CPUs exist (w/o Boot Guard), one may simply take a TPM and replay "golden" measurements to it. Bypassing this would be trivially easy. A TPM does not have control over execution on the CPU. It only receives data from the CPU. If you have control over execution on the CPU from the reset vector, you can just replay whatever you want to a TPM and extract secrets that way. That's why TPM backed disk encryption without configuring a PIN is insecure. Microsoft does not have the same level of control over the entire PC ecosystem as Google has over Android. That's why it's important to support open source alternatives.
  - deno 2y ago
    And that’s why Play Integrity is based on hardware attestation and it is no longer a swiss cheese? And Win11 requires specifically TPM 2.0 (usually fTPM) not just any TPM. You’re also entirely missing the point. Yes, you can bypass TPM based DRM to extract the unencrypted video (or just analog hole it) that’s why the game is to lock down the OS so you just can’t play it. If all DVD players came with watermark detection instead of copy protection you wouldn’t have bootlegs because now every single client device needs to do the bypass instead of just once to extract unencrypted stream. How many people have bypassed or hardware modded Playstations or Switches? This is what you’re talking about. Almost everyone will just accept it.
    - mkopec 2y ago
      > If all DVD players came with watermark detection instead of copy protection That is an enormous "if". Do you think Microsoft is going to or is able to enforce this on every single software provider? Even in your Android example that's just not happening, and you can happily sideload apps. You can still develop your own apps on the same Android phone that you use for banking. > And sorry but how many people have bypassed Playstations or Switches. This is what you’re talking about. Most people will just accept it. People accept this with consoles because a console is a device exclusively for consuming media, and all developers apply for a devkit. I just don't see that happening in the PC space. You think Microsoft is suddenly going to dump this on third party software developers and force everyone to go through certification and to buy devkits? Without a mass exodus to Linux?

by mkopec 2y ago

zinekeller 2y ago

In a sense, graphics cards are the root-of-trust for PC-based DRMs (as they implement the necessary components such as HDCP authentication), not the TPM (which is useless for this task). In fact, PlayReady (which is Microsoft's DRM solution) does this exact thing: https://learn.microsoft.com/en-us/windows/uwp/audio-video-camera/hardware-drm#:~:text=Windows%20implements%20the%20OEM%20proxy%20layer%20and%20transfers%20the%20serialized%20PRITEE%20functions%20calls%20to%20a%20user%20mode%20driver%20in%20the%20Windows%20Media%20Foundation%20subsystem.%20This%20will%20eventually%20get%20routed%20to%20either%20the%20Windows%20TrEE%20(Trusted%20Execution%20Environment)%20driver%20or%20the%20OEM%E2%80%99s%20graphics%20driver. https://learn.microsoft.com/en-us/windows/uwp/audio-video-ca... (...or use things such as the already-dead Intel SGX, which never touched TPMs at all)

deno 2y ago

It goes TPM → OS Integrity (dm-/fs-verity) → Browser Attestation (Web Integrity) → Your banking website no longer working on Linux because of "security". It’s Play Integrity for the PC. Encrypted video is a red herring. The real long game is to also get your "secure" video player to refuse playback if it detects watermark in the pirated video. This patches the analog hole. If you have attested Windows it can just refuse to download "freeworld" VLC because it can be used for piracy and/or even watching child pornography. Imagine that! Of course you can use Linux instead but now you have to use the approved distro that also won’t let you run "dangerous" apps. This is of course slippery slope argument and Microsoft would not be able to force all that right now, but better get started on the foundations. Some future government can then just force them to implement the rest, but by then it will be just a flip of a switch. "TPM is not DRM" argument seriously lacks imagination.

mkopec 2y ago
Google SafetyNet is basically swiss cheese with lots of bypass solutions for custom ROMs. A TPM may only attest that it has received an expected set of measurements (hashes). As long as discrete TPMs or PCs with unlocked CPUs exist (w/o Boot Guard), one may simply take a TPM and replay "golden" measurements to it. Bypassing this would be trivially easy. A TPM does not have control over execution on the CPU. It only receives data from the CPU. If you have control over execution on the CPU from the reset vector, you can just replay whatever you want to a TPM and extract secrets that way. That's why TPM backed disk encryption without configuring a PIN is insecure. Microsoft does not have the same level of control over the entire PC ecosystem as Google has over Android. That's why it's important to support open source alternatives.
- deno 2y ago
  And that’s why Play Integrity is based on hardware attestation and it is no longer a swiss cheese? And Win11 requires specifically TPM 2.0 (usually fTPM) not just any TPM. You’re also entirely missing the point. Yes, you can bypass TPM based DRM to extract the unencrypted video (or just analog hole it) that’s why the game is to lock down the OS so you just can’t play it. If all DVD players came with watermark detection instead of copy protection you wouldn’t have bootlegs because now every single client device needs to do the bypass instead of just once to extract unencrypted stream. How many people have bypassed or hardware modded Playstations or Switches? This is what you’re talking about. Almost everyone will just accept it.
  - mkopec 2y ago
    > If all DVD players came with watermark detection instead of copy protection That is an enormous "if". Do you think Microsoft is going to or is able to enforce this on every single software provider? Even in your Android example that's just not happening, and you can happily sideload apps. You can still develop your own apps on the same Android phone that you use for banking. > And sorry but how many people have bypassed Playstations or Switches. This is what you’re talking about. Most people will just accept it. People accept this with consoles because a console is a device exclusively for consuming media, and all developers apply for a devkit. I just don't see that happening in the PC space. You think Microsoft is suddenly going to dump this on third party software developers and force everyone to go through certification and to buy devkits? Without a mass exodus to Linux?