Hacker News Reader

Comment by josteink | Hacker News Reader

I’m no expert, but to me it sounds like you are describing UEFI Secure Boot, not TPM.

Case in point: TPM is not required to implement UEFI Secure Boot. You can test yourself in a QEMU VM, if you don’t believe me.

From my understanding, TPM is just a separate crypto-module meant to keep the keys secret even from the CPU and OS itself, allowing you to do various crypto and security related things with higher confidence of the keys not getting leaked.

Applications includes passwordless disk-encryption (MS BitLocker) but also hard-to-crack DRM, making the TPM a somewhat controversial piece if hardware.

Someone please correct me if I’m wrong or my answer is inaccurate in any way ;)

View on HN

As someone who's spent too much time with this stuff, you're correct. The TPM (either 1.2 or 2.0) is an entirely _passive_ chip. It only creates keys or measures data if the OS or UEFI asks it to. This means that it can't block or modify programs on your CPU.

Secure Boot is implemented by UEFI, so it can block the loading of a particular bootloader. You can have Secure Boot without a TPM or have a TPM without Secure Boot. They can be useful together though as you can have a disk-encryption key with a policy saying "I can only decrypt stuff if you've booted using Secure Boot in a particular configuration".

As for DRM, the TPM doesn't work very well as part of a DRM solution (as it's entirely passive). This is probably why very few (if any) DRM products use TPM. Most PC DRM that I've heard of either uses Windows Kernel modules or Intel SGX.

> Case in point: TPM is not required to implement UEFI Secure Boot. You can test yourself in a QEMU VM, if you don’t believe me.

I believe you, but doesn't that mean that there is nothing particular secure about this operation ?

But thank you for the correction, I was under the impression that secure boot neccessarily needs a TPM to store it's keys.

> but doesn't that mean that there is nothing particular secure about this operation ?

Not at all. The trusted signing-certificates don’t need to be stored securely since they only contain public keys.

This is typically stored in NVRAM or EFI-variables.

Reply on news.ycombinator.com