Takeaways
The use of a discrete (physical) TPM actually decreases the security of the system, using a fTPM would solve the problem.
If the discrete TPM has to be used, then a PIN or passphrase on BitLocker is necessary.
I always considered that BitLocker without a PIN is 80% convenience and 20% security.
void encryptSector(struct context *c, long sector_no, unsigned char *data, size_t data_len) {
// TODO
}Since only dTPM can be FIPS certified, I don't see how an uncertifiable piece of hardware can be more secure.
It's incredibly slow to adapt to new technology.
fTPM has a different attack surface, and protects against this specific attack. It's most likely better than dTPM for hardware based attacks, but there's known attacks as well