Hacker News Reader

Comment by transpute | Hacker News Reader

Do you know if the motherboard has pins for a discrete TPM 2.0 module, e.g. https://www.asrock.com/mb/spec/product.asp?Model=TPM-SPI & https://download.asrock.com/Manual/TPM-SPI.pdf

View on HN

Does a discrete TPM offer specific advantages over an fTPM? I suppose it'd be modular but I can't really imagine trusting AMD to run the entire operating system but then saying they can't be trusted to hold a key and being fine with that in the same system. Not that I'm saying they are therefore perfectly secure rather I'm not sure what risks profiles it really avoids so perhaps other advantages exist too?

Sadly, AMD PSP-based fTPMs emulate only a subset ("Mobile TPM" spec) of a discrete client TPM. This could be addressed with a PSP software update, since the Microsoft reference code for TPMs is open-source.

A full TPM implementation is required to use DRTM (SKINIT) for measured Linux Secure Launch, which is useful for home servers to confirm that the boot loader, kernel and optional immutable OS/VMs have not been modified. Unlike "Secure Boot" SRTM, DRTM adds launch integrity with policy defined by the hardware owner. One would typically use SRTM+DRTM.

The TPM emulation in Microsoft Pluton, which is present in some Ryzen chips, might be sufficient for DRTM. It's tragic that AMD fTPM has limited functionality, since AMD provides SKINIT on all SKUs, unlike Intel where TXT DRTM is limited to vPro.

Some ASRock 4x4 (NUC-sized) mini PCs have pins for discrete TPM.

Generally the other way, if you're paranoid -- the fact that it's separate component allows an attacker to MITM the communication.

Not according to the spec sheet or the PCB photos[0][1] they provide, no.

[0]: https://www.asrock.com/nettop/photo/DeskMeet%20X600%20Series... [1]: https://www.asrock.com/nettop/photo/DeskMeet%20X600%20Series...

Reply on news.ycombinator.com