Hacker News Reader

It's worth mentioning that standalone TPM chips from Infineon and others are a lot more hardened than Intel or AMD's fTPMs. Infineon's TPMs are tested against fault injection attack, package removal, side channels and so on.

View on HN

Please note, though, that's imperative to then go for a BitLocker TPM+PIN configuration at least. A standalone (discrete) TPM with TPM-only protectors can be attacked by bus sniffing, a hardware attack much simpler than ours. [1]

The beauty of a discrete TPM is its anti-hammering protection, making a numerical PIN a very effective security measure (akin to a SIM/SmartCard).

[1] https://www.sciencedirect.com/science/article/pii/S089812211...

Bus sniffing can be mitigated by encrypting communications using the TPM's in-built parameter encryption capabilities.

Yes, this. Bitlocker could absolutely do this.

There's still other active attacks resulting from the BMC and BIOS and parts of the OS not also doing the encrypted session thing.

Reply on news.ycombinator.com