Any ideas on using TPM in a Windows 11 VM

jimbo45 · Jul 28, 2021

Hi folks
I've got the tpm2 (TPM ver 2) service running and enabled on a Linux Host (IBM emulator version)

Windows 11 now knows its there

but any ideas on what to do with it !!!!
I've read a bit on "encryption keys" etc - but the documentation such as there is leaves me cluelless
At least the VM now passes the hardware test even though the HOST itself (when running Windows) fails on CPU -- but I've poodlefaked that in the VM by emulating another "enabled" CPU -- no BSOD's yet

Anybody managed to get TPM encryption keys etc working -- I'm not just talking here about bitlocker.

Cheers
jimbo

barman58 · Jul 28, 2021

the TPM should automatically be utilised to store the keys used on the system, and this should controlled from within windows, not sure of how it works exactly but I think this may be "by Design"

There should be a TPM Management snap-in. if Win11 works the same way as Win 10

lx07 · Aug 26, 2021

jimbo45 said:
Any ideas on what to do with it !!!!

That's the real question. Everyone says you need tpm but for what? Bitlocker isn't new and nor is Windows Hello. Both work fine without on Windows 11 exactly as they did on 10.

What is the new security requirement it is needed for exactly? Does anything actually require it to work?

barman58 · Aug 26, 2021

Just think of it as a lockbox to keep your Keys in

It's a physical device to encrypt and store your application keys, ( including the OS key), and user passwords, it helps to secure your system from outside attacks.

Superfly · Aug 26, 2021

barman58 said:
Just think of it as a lockbox to keep your Keys in It's a physical device to encrypt and store your application keys, ( including the OS key), and user passwords, it helps to secure your system from outside attacks.

Hmmm. I find this TPM thing quite interesting - indulge me for a minute ok?

So let's say the OEM injects the product key (or more like an HWID with a generic key ala Win 7) into TPM on Win 11 machines at the factory - do they then need a decryption key to activate Windows? much like Win 7 had OEM/PC model specific certificates? That would be an interesting turn of events as the key is stored in a read-only firmware table as plain text at present.

barman58 · Aug 26, 2021

The way I understand it is that, like the way the login PIN works, its not available except from a local keyboard so cannot be accessed remotely, this is why the PIN is classed as a higher rated security device than a password, which when I first heard this made no sense to me until the lockout was explained .

The TPM is secure in the same way as long as you are local to the system where as the ROM location in the firmware is susceptible to outside attack and is plain text too .

I'm not fully up to date with the security levels embedded in windows these days, but this is what was explained to me when the first TPM modules were used to hold the embedded Licence key for some high end laptops

lx07 · Aug 26, 2021

I don't think the tpm stores the keys rather it has it's own private key that the os can use to validate whatever as root of trust. I suppose it's to make Windows Hello more secure (as you can make it the only sign on option on 11) but idk technically what it's required for.

barman58 · Aug 26, 2021

Here is a definitive explanation from The Trusted Computing Group which is a consortium of Developers, hardware, and software

Hopefully it will open all our eyes :look:

Trusted Platform Module (TPM) Summary | Trusted Computing Group

TPM (Trusted Platform Module) is a computer chip (microcontroller) that can securely store artifacts used to authenticate the platform (your PC or laptop). TPM (Trusted Platform Module) is a computer … Continue reading "Trusted Platform Module (TPM) Summary"

trustedcomputinggroup.org

Superfly · Aug 26, 2021

barman58 said:
Here is a definitive explanation from The Trusted Computing Group which is a consortium of Developers, hardware, and software

Hopefully it will open all our eyes

Trusted Platform Module (TPM) Summary | Trusted Computing Group

TPM (Trusted Platform Module) is a computer chip (microcontroller) that can securely store artifacts used to authenticate the platform (your PC or laptop). TPM (Trusted Platform Module) is a computer … Continue reading "Trusted Platform Module (TPM) Summary"

trustedcomputinggroup.org

Thanx Nigel, yep we need to be very careful with our artefacts on our platforms (who comes up with this terminology.. LOL)

Any real world applications in practice, however (apart from Bitlocker and Windows Hello)?

barman58 · Aug 26, 2021

Well it does list a few towards the end of the document ...

These capabilities can improve security in many areas of computing, including e-commerce, citizen-to-government applications, online banking, confidential government communications and many other fields where greater security is required. Hardware-based security can improve protection for VPN, wireless networks, file encryption (as in Microsoft’s BitLocker) and password/PIN/credentials’ management

The other interesting Factoid ...

over 100 million branded PCs and laptops with TPMs were sold in 2007

Any ideas on using TPM in a Windows 11 VM

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Similar threads