Protecting systems with the TPM [LWN.net]

Protecting systems with the TPM

Posted Feb 18, 2016 4:58 UTC (Thu) by ras (subscriber, #33059)
In reply to: Protecting systems with the TPM by rahvin
Parent article: Protecting systems with the TPM

> I'd wager 90% of the time it's included in a computer it's never even used and it's rarely included. ... Go on Dell, HP or one of the computer manufacturers and try to find a computer with a TPM module builtin (your best bet is Lenovo BTW).

My last Dell two laptops (Precision and now XPS) do have TPM's, and I gather that is usually the case for "work" oriented Dell's.

You are right in saying it is a rare person that uses them (certainly I didn't) - but that has to come with a big qualification. It only applies to PC's. My phone has a TPM like thingy, and it is switched on by default. That isn't unusual. In fact in a few years I'd say most people will use hardware protect provided by a TPM like device every day of their lives.

When I ask myself why I am happy to use it on my phone but not my PC, the answer seems to be I am pretty confident I won't lose data on my phone due to the TPM. At least I haven't yet, and it's gone through a fair few firmware upgrades. On the other hand I have a friend who did turn on disk encryption for his Mac and one mishap or so later, he lost everything stored there. (It was backed up, but turns out Time machine encrypted the backup with the sealed key.) It happened to contain his wife's photo collection from an overseas holiday, so he wasn't a popular boy. Colour me skeptical, but if I ever get around turn on full disk encryption on Debian testing and seal the key with the TPM, I also fully expect to lose all the data on the disk; repeatedly.

If that expectation changes to me believing it works as well on my PC as it does on my phone, I would enable the TPM and full disk encryption as a matter of course, and I'd hope my distro would do that by default.

I guess the point I'm trying to make is that people do find TPM's useful, they only avoid them because they are too hard to use. Microsoft, Apple and Google are now doing an excellent job of making it obvious they don't have to be hard to use. It seems we in the open source world are learning how to deploy TPM's them, not the other way around.

to post comments

Protecting systems with the TPM

Posted Feb 19, 2016 2:11 UTC (Fri) by rahvin (guest, #16953) [Link] (1 responses)

>My last Dell two laptops (Precision and now XPS) do have TPM's, and I gather that is usually the case for "work" oriented Dell's.

Yea, but were they accessible? There's been a shocking tendency with TPM to build them in because they are so cheap and then just disable them in the bios with no way to activate them. That is unless you pay extra for the model with the bios that enables them.

Until the PC side figures out how to do TPM right like on the Phone side I would avoid them. My experience on windows with TPM was terrible honestly. But the technology is quite powerful if you use it right. The FOSS community has really smart people looking at this. I can actually see this being a key feature some day and I can see FOSS leading the way here. Microsoft's support of TPM has always been pretty terrible, I don't see that changing very soon.

Protecting systems with the TPM

Posted Feb 19, 2016 3:01 UTC (Fri) by ras (subscriber, #33059) [Link]

> Yea, but were they accessible?

It definitely was working in the precision. The XPS having TPM 1.2, and 1.2 being on the way out due to SHA-1 has sapped my interest. The kernel on the XPS seems to know about it, though.

> Until the PC side figures out how to do TPM right like on the Phone side I would avoid them.

Yes, well my take is TPM 1.2 is just too hard to use. Matthew's says the brittleness problem can be solved by resealing, but getting that right for software you control sounds hard and for software that changes underneath you (BIOS, host software in a VM) sounds impossible. Maybe TPM 2.0 will fix that, but given you can't buy one yet that's a long way out. And besides, I care more about keeping the data on my laptop accessible than I care about keeping it secure. So maybe it will never be good enough.

However, my laptop isn't where my interest lies. I am responsible for keeping customer data secure on VM's managed by others. My "responsible" approach is to keep it to a minimum and cross my fingers. If it was a joke it might even be funny. It almost brought an audible sigh of relief from me when I heard Matthew say he was working on extending the TPM into containers. The interesting thing is I don't even care that it's brittle and so probably will lose my data. That's mostly because VM's are already very good at losing my data.

One thing I don't understand is why they don't put the TPM on the CPU die. Why everyone thinks putting the TPM on an external bus where it can be reset at will with a minimal amount of hardware is a complete mystery to me. The TPM's integrity depends on being able to provide a tamper evident audit trail from boot. If you can reset it without resetting the rest of the system you can re-program that audit trail to be whatever you want. So if it's not on the die, it can only provide a very moderate level of protection.

Protecting systems with the TPM

Posted Feb 19, 2016 18:05 UTC (Fri) by foom (subscriber, #14868) [Link]

Macs don't even have a TPM, and never have. (Well, the very first Intel macbook did, probably was in the default Intel reference design or something, but there was never a driver for it).

Whatever problem your friend had with disk encryption in MacOS can't be blamed on a TPM...