Hacker News Reader

Signing with the TPM doesn't work super well, given that the TPM's inherent keys can't be used for signing as a privacy protection mechanism. You'd need to store an encrypted key in the image that could be used for signing purposes, but what stops an attacker from simply wiring up the TPM directly, generating a new key pair, and storing that instead? This is a legitimately difficult problem to solve well.

View on HN

> but what stops an attacker from simply wiring up the TPM directly, generating a new key pair, and storing that instead

Simply?

Did you just equate resetting a bios password with wiring up a TPM and generating a new key pair?

The situation we're discussing already involves taking the machine apart to short the security eeprom during boot. Once you've accepted physical attacks as part of your threat model it seems reasonable to say that any mitigations you're designing should be resilient to physical attacks as well.

TPM is nonsense, i can trivially replace the processor/TPM module w/ whatever I wish.

If it was used to encrypt a disk, then what does replacing TPM accomplish exactly?

if the disk is encrypted, then the bios password does nothing at all. The access to the BIOS is a separate issue entirely.

Why are we even discussing TPM if it is not being used for its main purpose?

Reply on news.ycombinator.com