Solved TPM/PTT confusion

Zardoc · Jul 19, 2021

Has nothing to do with manufacturing, has to do with the O/S. You can use or not use secure boot. The choice is there. You're eliminating a lot more computers than with a simple O/S upgrade

johnlgalt · Jul 19, 2021

Sorry. You can call it a cash grab, but I don't. Otherwise, Windows 3, 3.1, 3.11, 95, 98, 98 SE, 2000, ME, NT and all the variants, Xp, 7, 8, 8.1, and 10 were all cash grabs.

Zardoc · Jul 19, 2021

You're opinion, I respect that.

Dru2 · Jul 20, 2021

Stigg said:
Hi @gmemore
I've always built mine too, but it never crossed my mind to look for TPM headers on my motherboards.
As it turns out, the most recent motherboard I purchased has one. But there is another problem.
The GC-TPM2.0_S TPM module for my GIGABYTE X299X DESIGNARE 10G is not available anywhere, and from my research, GIGABYTE have no intention of making it available.

So, the lesson for anyone intending on buying a new motherboard is ensure that your motherboard has a TPM header and ensure that TPM module stock is available. I would suggest buying the TPM module when you buy the motherboard to be safe.

As stated many many many times.... newer motherboards already have firmware TPM built into them. There is no need to buy a dedicated TPM module because firmware TPM works just fine. Again, stated many many times.

With that your Gigabyte X299 Designare DOES have firmware TPM in the BIOS. On your board it would be called "Trusted Computing" As seen in your owner's manual on page 55 which can be downloaded here - X299X DESIGNARE 10G (rev. 1.0) Gallery | Motherboard - GIGABYTE Global.

You just have go into the BIOS and enable it (usually off by default). This will not cause any issues or "automatically" enroll you in BitLocker.

With that people need to read their owner's manual BIOS section to see if there's a TPM setting there and go into the BIOS and enable it instead of buying something they don't need or understand.

In short, if your board has FTPM (firmware TPM) you don't need to fill the TPM header already built into the board.

The dedicated TPM header is for those wanting more robust security. If you don't know what that is you don't need it. All Windows 11 requires is FTPM, which just about any motherboard past 2013 should (will) have.

Good luck.

bobkn · Jul 20, 2021

Dru2 said:
(snip)

The dedicated TPM header is for those wanting more robust security. If you don't know what that is you don't need it. All Windows 11 requires is FTPM, which just about any motherboard past 2013 should (will) have.

Good luck.

Perhaps this has already been answered, but: How is a discrete TPM "more robust" than firmware TPM? (Not a rhetorical question.)

Dru2 · Jul 20, 2021

bobkn said:
Perhaps this has already been answered, but: How is a discrete TPM "more robust" than firmware TPM? (Not a rhetorical question.)

This has been posted about 20 times... Intel Platform Trust Technology (PTT): TPM For The Masses

Under Understanding TPM...

Implementing TPM in dedicated hardware has a key benefit. TPM isolates the security infrastructure from the host system, making it exceedingly difficult to spoof, tamper or defeat. But it adds cost and complexity to system designs, which means that a lot of devices that could benefit from this level of security, simply don’t have it.

From there the article goes into Intel's Platform Trust Technology

bobkn · Jul 20, 2021

Dru2 said:
This has been posted about 20 times... Intel Platform Trust Technology (PTT): TPM For The Masses

Under Understanding TPM...

From there the article goes into Intel's Platform Trust Technology

A bit weak on technical detail, but OK. (Example: A TPM stores some information in an EEPROM. Where does fTPM store it? "Firmware" suggests that it might use the same EEPROM as the motherboard's BIOS. Or is there a separate EEPROM?) And it doesn't make it clear (to me, at least) whether discrete TPM is more "robust" than fTPM. It suggests PTT as a practical alternative to a discrete TPM, but says nothing about any possible shortcomings compared to the discrete version.

PerpetualCycle · Jul 20, 2021

bobkn said:
A bit weak on technical detail, but OK. (Example: A TPM stores some information in an EEPROM. Where does fTPM store it? "Firmware" suggests that it might use the same EEPROM as the motherboard's BIOS. Or is there a separate EEPROM?) And it doesn't make it clear (to me, at least) whether discrete TPM is more "robust" than fTPM. It suggests PTT as a practical alternative to a discrete TPM, but says nothing about any possible shortcomings compared to the discrete version.

If you want technical details, here you go for PTT. Good luck:

https://www.intel.com/content/dam/www/public/us/en/security-advisory/documents/intel-csme-security-white-paper.pdf

Dru2 · Jul 20, 2021

bobkn said:
A bit weak on technical detail, but OK.

I didn't write it.

Maybe Microsoft can shed some further light for you - Trusted Platform Module (Windows 10) - Microsoft 365 Security

bobkn · Jul 20, 2021

geneo said:
If you want technical details, here you go for PTT. Good luck:

https://www.intel.com/content/dam/www/public/us/en/security-advisory/documents/intel-csme-security-white-paper.pdf

Thanks. Probably far beyond me, but a mere 30 pages. I can pretend to read that. :wink:

swarfega · Jul 20, 2021

I was going to upgrade to the 5900x but after the recent shortages I decided to skip it and wait for AM5. By then Windows 11 will have settled in too.

PerpetualCycle · Jul 20, 2021

bobkn said:
Thanks. Probably far beyond me, but a mere 30 pages. I can pretend to read that.

Well just look at the architecture part if you are interested in where keys are stored.

Dru2 · Jul 20, 2021

bobkn said:
Thanks. Probably far beyond me, but a mere 30 pages. I can pretend to read that.

Yes, but it'll answer some of those deep dive questions some like to ask and argue over :wink:

bobkn · Jul 21, 2021

Dru2 said:
Yes, but it'll answer some of those deep dive questions some like to ask and argue over

Ask, yes. Argue, not so much. Just the facts.

Scramjet · Jul 22, 2021

I am expecting the asus TPM module in a few days. Right now I have created the registry entry ' LabConfig" set to the TPM and SecureBoot to 1 so I can test Windows 11 Preview on my system. Would it be safe to delete that entry just before I install the module so that when I boot the Win11 Preview drive it will detect both TPM and Secureboot?
thanks

NavyLCDR · Jul 22, 2021

Scramjet said:
I am expecting the asus TPM module in a few days. Right now I have created the registry entry ' LabConfig" set to the TPM and SecureBoot to 1 so I can test Windows 11 Preview on my system. Would it be safe to delete that entry just before I install the module so that when I boot the Win11 Preview drive it will detect both TPM and Secureboot?
thanks

The registry entries only affect Windows setup.exe. They have no affect on the OS itself once it is installed. If you have Windows 11 installed already, you can delete the registry entries now without TPM installed or secure boot enabled.

Wynona · Jul 22, 2021

Zardoc said:
I have a Z590 Asus board and the TPM/PTT is included with the motherboard. My wife has a Z270 Prime A and I had to add the chip on the board and it works flawlessly. I still think that this is a cash grab but hey, a lot of are still surprised that we can install Windows 10 on 10-12 year old computers.

I wouldn't call it a cash grab, especially since Microsoft has announced updating from Windows 10 to Windows 11 will be free according to numerous reputable sources I regularly visit. Further, Windows 10 will be supported until late 2025.

We checked to see if my Windows 10 students' computers will run Windows 11 yesterday and found that all but two are upgradeable to Windows 11. Those two were more than five years old, so it was no surprise. I had already predicted they wouldn't pass.

Throughout the history of Windows (I was around for Windows 3.0 and 3.1), every few years, Microsoft has improved (with a few bobbles) on Windows. I have had the privilege of beta testing most of those new operating systems.

Cash grab? Nope, I would call it progress.

Scramjet · Jul 22, 2021

NavyLCDR said:
The registry entries only affect Windows setup.exe. They have no affect on the OS itself once it is installed. If you have Windows 11 installed already, you can delete the registry entries now without TPM installed or secure boot enabled.

ok cool thanks

Zardoc · Jul 22, 2021

Wynona said:
I wouldn't call it a cash grab, especially since Microsoft has announced updating from Windows 10 to Windows 11 will be free according to numerous reputable sources I regularly visit. Further, Windows 10 will be supported until late 2025.

We checked to see if my Windows 10 students' computers will run Windows 11 yesterday and found that all but two are upgradeable to Windows 11. Those two were more than five years old, so it was no surprise. I had already predicted they wouldn't pass.

Throughout the history of Windows (I was around for Windows 3.0 and 3.1), every few years, Microsoft has improved (with a few bobbles) on Windows. I have had the privilege of beta testing most of those new operating systems.

Cash grab? Nope, I would call it progress.

Wynona, I respect your opinion.
I did all the same things as you. I was a 7 year MS MVP beta tested a bunch of Windows (I have a bunch of old beta CDs and floppies) :wink:

I'm all for technology and progress even the TPP security chips because of firmware attacks. If not, I wouldn't be here at all. First MS is not giving the OS upgrade for free because they love us.
I can run a windows XP on this machine. In fact embedded got support until 2019 that's 18 years. You can even run Windows 95 as an app on Windows 10.

The problem is forcing everyone to use it. I have Bitlocker and I don't care to use it and probably never will, but does it mean I'm against the this great tool?, but I decide if I want it or not. This chip imposed decision means that the door has been shut on anything that doesn't have TPM with future OS's. If you just let users have the choice, we will get to the same results and they will need to upgrade eventually but some people will be able to use a modern FREE OS with the older machines for just as long as those having fun with Windows XP. This method pushes a lot of people to go out and grab a new machine or chip or wait for a bios update (good luck with that) because some Intel & AMD chips have TPP technology embedded. So the cash grab isn't with the OS, it's saying to it's partners, there you go, now they all have to get modernized a bit faster. Asus and the other boys are probably sending thank you cards to MS.

I'm sure not everyone will agree with me but that's OK, besides I'm not going to change a thing by my lonesome self. :wink:

PerpetualCycle · Jul 23, 2021

Wynona said:
I wouldn't call it a cash grab, especially since Microsoft has announced updating from Windows 10 to Windows 11 will be free according to numerous reputable sources I regularly visit. Further, Windows 10 will be supported until late 2025.

Yes, it will be free by fiat since the Microsoft requirement of 8th gen and older CPU (similar for AMD?) have a TPM built into the chipset