Contents
What is data binding and sealing?
Binding: Encrypts data using the TPM bind key, a unique RSA key descended from a storage key. Sealing: Similar to binding, but in addition, specifies the TPM state for the data to be decrypted (unsealed). Other Trusted Computing functions for the data to be decrypted (unsealed).
What is TPM handle?
Permanent entities have a handle that is fixed by the TPM specification. The handle value can’t change; nor can such an entity be created or deleted. Its data can be either persistent or volatile. When the object is made persistent, it’s called a persistent entity. An entity’s Name is its unique identifier.
What will happen if you clear TPM?
Clearing the TPM can result in data loss. Clearing the TPM causes you to lose all created keys associated with the TPM, and data protected by those keys, such as a virtual smart card or a login PIN. Make sure that you have a backup and recovery method for any data that is protected or encrypted by the TPM.
What is BitLocker TPM?
BitLocker disk encryption normally requires a TPM on Windows. TPM stands for “Trusted Platform Module”. It’s a chip on your computer’s motherboard that helps enable tamper-resistant full-disk encryption without requiring extremely long passphrases.
Do I need a TPM chip for Windows 11?
A TPM (aka trusted platform module chip) is a cryptoprocessor that secures a computer through an integrated cryptographic key. The chip is necessary to run Windows 11, as Microsoft wants to put more focus on safety and keeping its platforms secure.
What happens when a TPM device is sold?
If a TPM device is sold to a new owner, the new owner can take ownership of the TPM to generate a new SRK, which ensures the previous owner can’t use the TPM. Because the SRK is unique to the owner of the TPM, the SRK can be used to seal data into the TPM itself for that owner.
What’s the storage root key on a TPM?
There’s another type of key that TPMs have, called the storage root key (SRK). An SRK may be generated by the TPM’s owner after it takes ownership of the TPM. Taking ownership of the TPM is the TPM-specific way of saying “someone sets a password on the HSM.”
How is the TPM used to protect certificates?
The TPM can be used to protect certificates and RSA keys. The TPM key storage provider (KSP) provides easy, convenient use of the TPM as a way of strongly protecting private keys. The TPM KSP can be used to generate keys when an organization enrolls for certificates, and the KSP is managed by templates in the UI.
How to use TPM for full disk encryption?
This works and has the desired behavior – if the boot process has been tampered with (let’s say adding init=/bin/sh to the kernel command line to bypass a root password) the TPM refuses to unseal the key and the system is thus safe. First, the TPM requires the SRK password every time a sealing/unsealing operation is performed.