Hacker News Reader

Isn't this one of the things TPMs are designed to defend you against? The TPM only releases the encryption key after the right password is entered, some number of wrong passwords cause a reset, and perhaps a single duress code instantly causes a reset? Once the TPM is erased, who's to tell if it wasn't just broken to begin with.

View on HN

You mirror drives as part of evidence collection

. . . which is subsequently rendered useless by the TPM erasing itself.

(The standard procedure is to encrypt the drive using a key stored in the TPM. The TPM then decrypts the drive when provided with the proper authentication. If the designated security policy is violated the TPM destroys the key, rendering the drive's contents useless.)

They're mirroring the drive. Why wouldn't they mirror the TPM too? Or are you contending they're tamperproof?

They are intended to be tamperproof, yes. Mirroring the contents of a TPM is an exercise in hardware deconstruction where you also have to worry about setting of auto-erase traps. It's not impossible by any means, but it's not standard procedure and there's no guarantee it will actually work.

Reply on news.ycombinator.com