Do I need a hardware tpm(or ftpm) or am I good to go?

bobkn · Apr 11, 2023

xraiderv1 said:
and lastly..how the devil do I remove and replace standoffs, on the off chance my motherboard should require different standoff positioning? I cant seem to find an answer on that one.

edit: I am aware microcenter can build the rig for me, but I find myself anticipating the challenge of building it myself to be honest.

On every case I've had, the standoffs have been hexagonal. I've used a small hex socket with them. They haven't all used the same thread into the case, though. It may be possible to strip the threads, but I've never done it. (And I'm not a neurosurgeon.)

I'd expect that the standoffs to be pre-installed for a full-sized ATX board. Like the one on your list.

If you buy a hardware TPM, you'll be a member of what I believe is a small minority. (Maybe a happy one, but my two desktop systems run with firmware TPMs. I don't use Bitlocker, though, assuming that matters.)

SIW2 · Apr 12, 2023

a lot of people use resellers like premiumcdkeys which mikes unboxing suggests

Bryan at Tech Yes suggests a different one scdkeys

there are others I believe navylcdr used a different reseller which he might be able to tell you about.

caveat emptor

jimbo45 · Apr 12, 2023

xraiderv1 said:
off topic but related to the windows 11 bit, is it possible to make a windows 11 bootable flash drive whilst running in a windows 10 environment? if so I'll probably just make a bootable, and pay for a 10 key off microsoft.

Hi there
If you are wanting a "Full W11" install you can do it easy easily enough via dism / Apply-Image from the relevant Windows iso install -- get either from Ms or create one by downloading the script from UUPDUMP or equivalent.

There's plenty of details on how to create a "Windows to Go" system (for Free -- no 3rd party paid software needed e.g Hasleo etc) on this site..

If you just want a Windows INSTALLATION bootable usb drive then from the iso image just run rufus.

Not clear on what you want. !!(At least to me).

Cheers
jimbo

xraiderv1 · Apr 12, 2023

when I say bootable windows drive..I mean installation media ^^;

tinmar49 · Apr 28, 2023

The TPM built into processors certainly works and is free and satisfies W11 reqirrements. When W11 first came out, the prices of plug in TPM modules went through the roof, but they are cheap now. They all seem to be based on an Infeon chip. What has not been explained is why motherboard manufacturers bother to include the circuitry and connections for the plug in modules when all processors compatible with W11 appear to have the built in TPM.

Steve C · Apr 30, 2023

tinmar49 said:
The TPM built into processors certainly works and is free and satisfies W11 reqirrements. When W11 first came out, the prices of plug in TPM modules went through the roof, but they are cheap now. They all seem to be based on an Infeon chip. What has not been explained is why motherboard manufacturers bother to include the circuitry and connections for the plug in modules when all processors compatible with W11 appear to have the built in TPM.

I just built a new PC using an Asus Z790 board and there isn't an option for a plug in TPM module!

tinmar49 · Apr 30, 2023

Checking the specs, Asus have deleted TPM headers on at least some of their modern boards, but similar boards from Asrock still have them.

xraiderv1 · Apr 30, 2023

Steve C said:
I just built a new PC using an Asus Z790 board and there isn't an option for a plug in TPM module!

check the manufacturer's website for their bios section and see if it adds support for a bios based tpm or ftpm(the terminology will be different depending on if its intel or amd), it may just say 'added support for windows 11'.

Buddywh · May 12, 2023

Ghot said:
Discrete TPM is a physical module. They are almost impossible to get and even if you do, they are probably counterfeit.

...

Would someone expand on this please?

Specifically: what's meant by "counterfeit" in this context. Is it the TPM module in its entirety that's counterfeit? or is it the TPM chip on the module?

I recently bought a TPM 2.0 module for my Asus motherboard which uses a Nuvoton TPM 2.0 chip on it. Win11 has recognized it, taken ownership of it and provisioned it so that it's operating about as well as I think it should. But of course, I've no idea if it's working exactly as it should or just pretending too.

I got the module off Amazon where it's readily available and not that expensive. If the module itself is counterfeit I don't care (Asus might). But if the chip is counterfeit...well, how would I know? I know of no way to check it's functioning so can't tell.

The module itself is exceptionally simple: just the TPM chip and a couple passive devices. So if the Nuvoton chip is impossible to easily counterfeit in a way that creates a security breach (because of the way a TPM works, perhaps??) once again, why should I care? Nuvoton might.

Ghot · May 12, 2023

Buddywh said:
Would someone expand on this please?

Specifically: what's meant by "counterfeit" in this context. Is it the TPM module in its entirety that's counterfeit? or is it the TPM chip on the module?

I recently bought a TPM 2.0 module for my Asus motherboard which uses a Nuvoton TPM 2.0 chip on it. Win11 has recognized it, taken ownership of it and provisioned it so that it's operating about as well as I think it should. But of course, I've no idea if it's working exactly as it should or just pretending too.

I got the module off Amazon, not that expensive. If the module itself is counterfeit I don't care (Asus might). But if the chip is counterfeit...well, how would I know? I know of no way to check it's functioning so can't tell.

When the Windows 11 requirements first came out... a lot of shady hardware manufacturers, slapped together TPM modules and sold them on Amazon. They didn't work... it was just a scam.

The true motherboard manufacturers actually did make TPM modules, but no one was buying them, so they stopped selling them. That was then... now... there may be actual working TPM modules you can buy.

It sounds like you've found a working one.

Personally, I just use fTPM. I seriously doubt TPM or Secure Boot will stop hackers, in the long run.
I've seen too many unhackable things... get hacked, over the years.

As for how to be sure whether the module's chip is counterfeit... who knows. That's one of the reasons, I just stayed with fTPM (firmware TPM).

Buddywh · May 12, 2023

Ghot said:
...

Personally, I just use fTPM. I seriously doubt TPM or Secure Boot will stop hackers, in the long run.
I've seen too many unhackable things... get hacked, over the years.

As for how to be sure whether the module's chip is counterfeit... who knows. That's one of the reasons, I just stayed with fTPM (firmware TPM).

I was using the fTPM in my 5800X before but I was having problems with audio and game stuttering. I thought why not go the discrete route just to be certain since they're pretty cheap and available now. Turned out not to be the source of the problem but I'm leaving it in.

As far as security and "hacker-proof" goes.... it's just like locking your house. With your home, you have a couple locked doors, alarms on windows and put a safe hidden somewhere to store valuables: a layered defense. I view the TPM mechanisms as just one layer in a multi-layered defense of your data along with secure boot and anti-virus software and safe browsing practices amongst others.

But what won't do is if one of the layers turns out to be a way to compromise all the security. So that's why I was concerned by it possibly being a counterfeit TPM.

And as with your home: if you have something they know is there and really need or want they will get it. Even if it means breaking one finger and one toe at a time to get you to divulge it. Any kind of security, in any context, is illusory. It's only purpose is to slow them and frustrate them enough to make them leave for easier pickings.

Ghot · May 12, 2023

Buddywh said:
Any kind of security, in any context, is illusory

I wouldn't worry about the chip on the module. That the module works at all is a good sign, and as you said... at best, security is illusory.

Dru2 · May 12, 2023

Buddywh said:
I recently bought a TPM 2.0 module for my Asus motherboard which uses a Nuvoton TPM 2.0 chip on it. Win11 has recognized it, taken ownership of it and provisioned it so that it's operating about as well as I think it should. But of course, I've no idea if it's working exactly as it should or just pretending too.

I got the module off Amazon where it's readily available and not that expensive. If the module itself is counterfeit I don't care (Asus might). But if the chip is counterfeit...well, how would I know? I know of no way to check it's functioning so can't tell.

I said it once, I'll say it again - with modern motherboard's there's zero reason to purchase a dedicated TPM module just for Windows 11 as TPM is already built into the BIOS - either PTT, fTPM, or simply TPM. This is built into the BIOS.

Pretty much if you've bought a motherboard within the last say 8 years, chances are your BIOS already has some form of TPM built in. All it takes is either a review of your owner's manual, the BIOS or both.

Those buying dedicated TPM modules for new board's so to meet Windows 11 TPM requirements are simply wasting money. Add that now there's a question of legitimacy. Unfortunately, there is no easy way to know this, and truth be told can also lead to nefarious vendors planting spyware on the chip and selling them to unsuspecting customers.

My attitude is if you must buy a TPM module, get them from a trustworthy place, and if possible, one made from the vendor of your board. That said, if you have a fairly new board, and especially if the board supports "Windows 11", it is highly likely the board already has TPM in the BIOS.

Looking at the specs of @Buddywh, they should already have TPM built-in - meaning there was no need to buy a TPM module.

BTW, you can tell if your module is active and working by typing tpm.msc in either search or run, and you will get this module...

Status - The TPM is ready for use says TPM Is working.

TPM Manufacturer information - is the vendor's name, manufacturer version, and specification version. Windows 11 requires TPM 2.0.

Verify Trusted Platform Module (TPM) Chip on Windows PC

How to Check if Windows PC has a Trusted Platform Module (TPM) Chip

www.tenforums.com

Install or Uninstall TPM Diagnostics Tool in Windows 11 Tutorial

This tutorial will show you how to install or uninstall the TPM Diagnostics tool in Windows 11. Trusted Platform Module (TPM) technology is designed to provide hardware-based, security-related functions. A TPM chip is a secure crypto-processor that is designed to carry out cryptographic...

www.elevenforum.com

Good luck.

Buddywh · May 12, 2023

Dru2 said:
...

Looking at the specs of @Buddywh, they should already have TPM built-in - meaning there was no need to buy a TPM module.

....

If you'd read my response you'd see I was troubleshooting. Do remember that since Ryzen processors (at one time) were experiencing problems with audio glitching and game stuttering when using their in-built fTPM's.

The thing is, if counterfeiting is a problem then buying a (supposedly) manufacturer built device can't be assured unless you buy directly from the manufacturer and they don't seem to sell them directly. I bought an Asus-branded device on Amazon but that doesn't mean it's Asus approved, much less manufactured; the very definition of counterfeiting. And if Amazon isn't reliable enough...well I don't know who is since local shops just buy from whoever too but also don't stock them. Hence my question about counterfeiting.

john1955 · May 12, 2023

xraiderv1 said:
oh good...see this is my first foray into a full from the ground up system, that it comes at the time windows 11 is a thing, is interesting timing. I've never dealt with tpm/ftpm before, so I have no idea what to look for there.

I just did the same thing with my first ground up build since Windows XP. I'm keeping the old one that still runs XP, Win-7 32, Win-7 64 and Win-10 (unactivated). The new one is strictly Windows 11 Pro and so far I like it. I did not buy Win-11 Pro retail, I bought a Win-10 Pro CD on eBay and upgraded right away to save a few bucks. I did not get a graphics card and the non-gaming graphics are great. I never have done any gaming so if I ever start it wont be something that needs speed. Not at my age with my eyes

The 4 fans in the new case are way quieter that the two in the old case. I have to look at to see the fans spinning it to tell if it's turned on because I can't here it sitting right next to it. If I ever need more graphics speed I will just upgrade the CPU

Dru2 · May 12, 2023

Buddywh said:
If you'd read my response you'd see I was troubleshooting. Do remember that since Ryzen processors (at one time) were experiencing problems with audio glitching and game stuttering when using their in-built fTPM's.

First, to be clear, I don't use/build Ryzen/AMD systems. I'm strictly Intel. With that my point stands as I'm also aware AMD has BIOS TPM. That said, you also said, TPM turned out to not be the issue...

Buddywh said:
I was using the fTPM in my 5800X before but I was having problems with audio and game stuttering. I thought why not go the discrete route just to be certain since they're pretty cheap and available now. Turned out not to be the source of the problem but I'm leaving it in.

Which, in all honestly doesn't surprise me. I'm not aware of any TPM causing audio or gaming issues. But people post all sorts of stuff online, so...

Buddywh said:
The thing is, if counterfeiting is a problem then buying a (supposedly) manufacturer built device can't be assured unless you buy directly from the manufacturer and they don't seem to sell them directly. I bought an Asus-branded device on Amazon but that doesn't mean it's Asus approved, much less manufactured; the very definition of counterfeiting. And if Amazon isn't reliable enough...well I don't know who is since local shops just buy from whoever too but also don't stock them. Hence my question about counterfeiting.

My point in the counterfeit argument was to address your concerns brought up. That this could turn into an issue as so many people looking for TPM modules, that some enterprising hacker could inject some nefarious code into one to do whatever. And why I suggest you buy from legitimate sources. And known name brands.

I'm also talking experience as I once bought a TPM module for my board, "years before Windows 11", as I wanted to know what it was all about. It turned out I had zero need for a TPM module at that time. In my research, is where I learned of firmware (BIOS) TPM.

If you do not know why you need a TPM module, you don't need one other than to satisfy the new security requirements for Windows 11. In short, most users only need TPM cause it's a Windows 11 OS requirement. And most motherboards of today insure that via a BIOS setting.

Anyway, the module I bought was an actual "Gigabyte" TPM module for my Gigabyte board, not some fake knockoff...

When I bought that module in 2017, it was $27 dollars. Today it's going for $60 dollars. Why... the market is now in such a demand, especially from those less informed in thinking they need something they really don't. I still have this module, but it now sits in a draw collecting dust.

Buddywh · May 12, 2023

Dru2 said:
...
When I bought that module in 2017, it was $27 dollars. Today it's going for $60 dollars. Why... the market is now in such a demand, especially from those less informed in thinking they need something they really don't. I still have this module, but it now sits in a draw collecting dust.

hmmm...I just a few weeks ago bought this "genuine" Asus TPM for my board for $25. I put it in quotes because it says "ASUS" on it but......

You don't follow AMD so may not be aware of some of the teething problems of their new platforms. One was an issue where the fTPM did indeed cause sporadic problems as I related when operated in Windows 11. AMD released a new AGESA (essentially, AMD's CPU microcode) to mitigate it but some boards/BIOS' persisted with problems reported even after that. So, now you know: there is an example where the fTPM indeed can cause a problem if not mitigated. $25 wasn't that much so I went ahead to try it.

I hear what you're saying about the near-uselessness of a TPM for most people, but I may decide to enable bitlocker and it's already used for device attestation with some game launchers and I think with Win Hello if using a pin to log on to a Win11 account that's synced with your microsoft account.

Almost certainly it's not essential to use a TPM to do any of these things (except maybe to play those games where one is required) but I look at what Micosoft is doing and see a freight train barreling my way so figure don't fight it. The sooner my system is fully capable the safer it will be when they come out with something I won't be able to (like go to Win11 from Win10 on my older PC). That's all us little folk can do since I'm not willing to abandon it and learn Linux. Anything Apple is worse.

Dru2 · May 12, 2023

Buddywh said:
You don't follow AMD so may not be aware of some of the teething problems of their new platforms. One was an issue where the fTPM did indeed cause sporadic problems as I related when operated in Windows 11. AMD released a new AGESA (essentially, AMD's CPU microcode) to mitigate it but some boards/BIOS' persisted with problems reported even after that. So, now you know: there is an example where the fTPM indeed can cause a problem if not mitigated. $25 wasn't that much so I went ahead to try it.

I hear what you're saying about the near-uselessness of a TPM for most people, but I may decide to enable bitlocker and it's already used for device attestation with some game launchers and I think with Win Hello if using a pin to log on to a Win11 account that's synced with your microsoft account.

I'm just making a general statement. Also, you can use fTPM with BitLocker. Done it myself.

Yeah, I'm aware of AMD's growing pains, having been a member in those forums (Vista, 7, 8, 10) for some time now.

Anyway, I'm aware of the uses of TPM, and why I say you don't need a physical module unless you have a specific. If you don't know the need, then you don't need one. The only reason TPM is now such a buzzword is because of Windows 11.

BTW, it is possible to use BitLocker without a TPM. I'm sure Brink has a tutorial, but I find finding anything here with this search engine to be a challenge.

How to Use BitLocker Without a Trusted Platform Module (TPM)

BitLocker’s full-disk encryption normally requires a computer with a Trusted Platform Module (TPM). Try to enable BitLocker on a PC without a TPM, and you’ll be told your administrator must set a system policy option.

www.howtogeek.com

That said, your board already supports TPM, so the above won't apply. Just showing it's possible.

john1955 · May 12, 2023

Dru2 said:
First, to be clear, I don't use/build Ryzen/AMD systems. I'm strictly Intel. With that my point stands as I'm also aware AMD has BIOS TPM. That said, you also said, TPM turned out to not be the issue...

Which, in all honestly doesn't surprise me. I'm not aware of any TPM causing audio or gaming issues. But people post all sorts of stuff online, so...

My point in the counterfeit argument was to address your concerns brought up. That this could turn into an issue as so many people looking for TPM modules, that some enterprising hacker could inject some nefarious code into one to do whatever. And why I suggest you buy from legitimate sources. And known name brands.

I'm also talking experience as I once bought a TPM module for my board, "years before Windows 11", as I wanted to know what it was all about. It turned out I had zero need for a TPM module at that time. In my research, is where I learned of firmware (BIOS) TPM.

If you do not know why you need a TPM module, you don't need one other than to satisfy the new security requirements for Windows 11. In short, most users only need TPM cause it's a Windows 11 OS requirement. And most motherboards of today insure that via a BIOS setting.

Anyway, the module I bought was an actual "Gigabyte" TPM module for my Gigabyte board, not some fake knockoff...

View attachment 60006

When I bought that module in 2017, it was $27 dollars. Today it's going for $60 dollars. Why... the market is now in such a demand, especially from those less informed in thinking they need something they really don't. I still have this module, but it now sits in a draw collecting dust.

I tried to get that same one and it was not available from Gigabyte even though they keep advertising it. I selected it and clicked "buy" but after making my selections of product and that I was in the USA it ended up taking me to a generic page advertising other products. So I bought a new system instead.

cereberus · May 20, 2023

Dru2 said:
Where'd you see that? And what's "software TPM"?

The term software tpm is often used erroneously:

There are basically several types of TPM:

Discrete TPMs are dedicated chips that implement TPM functionality in their own tamper resistant semiconductor package. They are the most secure, certified to FIPS-140 with level 3 physical security resistance to attack versus routines implemented in software, and their packages are required to implement some tamper resistance. For example the TPM for the brake controller in a car is protected from hacking by sophisticated methods.
Integrated TPMs are part of another chip. While they use hardware that resists software bugs, they are not required to implement tamper resistance. Intel has integrated TPMs in some of its chipsets.
Firmware TPMs (fTPMs) are firmware-based (e.g. UEFI) solutions that run in a CPU's trusted execution environment. Intel, AMD and Qualcomm have implemented firmware TPMs.
Hypervisor TPMs (vTPMs) are virtual TPMs provided by and rely on hypervisors, in an isolated execution environment that is hidden from the software running inside virtual machines to secure their code from the software in the virtual machines. They can provide a security level comparable to a firmware TPM. Google Cloud Platform has implemented vTPM.
Software TPMs are software emulators of TPMs that run with no more protection than a regular program gets within an operating system. They depend entirely on the environment that they run in, so they provide no more security than what can be provided by the normal execution environment. They are useful for development purposes.

When people refer to software TPMs, they probably mean firmware TPMs.

I am not aware of any software TPMs on consumer pcs but I could be wrong about that.