What Are The Risks with Compatible/Cloned TPM Modules?

Mycenius · Jan 19, 2024

Hi All,

Just signed up (but was a previous lurker and occasional poster on Sevenforums and Tenforums). I'm a little late to the party upgrading to 11, as I have an older machine that failed the Win11 minimum requirements on a couple of fronts (Processor & GPU) so hadn't rushed to do anything about it. Anyway I am now (for full background read below, but my main question is in this first paragraph). The main point/question of my post, in the event I don't have fTPM and need to get a hw module (Gigabyte 20-1 pin GC-TPM2.0), is that due to the age of the MoBo it looks like there are essentially no Gigabyte OEM ones available anymore (mainly because I've waited 2 years to do this). So what are the risks or dangers (if any) with buying the "compatible" or cloned units from China - obviously they just might not work properly to start with (from a manufacturing quality perspective) or be faulty. But what about the security/encryption side, is there potential for these to be compromised or otherwise unreliable - or is their operation essentially secure due to their nature regardless of who or where they are made?

That's my main concern as I may have only the option of getting a cloned unit for my MoBo. You don't need to read further, BUT If you want the full background as to why I might need to go down this route read on...

I recently got a new game (BG3), first in some time, and didn't want to buy or build a whole new machine for it. So I had to upgrade my graphics to run it (and hopefully in the process help extend the PC's life a bit longer than I had been expecting). As a result I'm now only 'below-minimum' on the processor for Win11 so looking to upgrade; however the TPM2.0 requirement is flagged as a 'maybe' I presume (i.e. it's orange)? With regard to TPM, my Gigabyte H110 Motherboard's BIOS shows (it is updated to the latest version of fw) Intel PTT enabled and also Gigabyte TPM2.0 enabled as well. However it shows no device installed for the latter (which is correct as I currently don't have a TPM module physically fitted to the motherboard, obviously). The Windows 10 TPM control panel/console also shows TPM capability but no TPM source/device present. This suggests to me there is no fTPM.

I was presuming MoBo should have had fTPM via Intel PTT, especially with the latest fw, however:

the MoBo BIOS & Manual say for the Hardware PTM2.0 to be enabled then Intel PTT must be enabled first (which is contrary to my understanding of this - you either have Intel PTT enabled or you have the MoBo Manufacturer Hardware PTM enabled, not both?), and
the Gigabyte press releases in 2021 suggest the '100' series MoBos were excluded from the firmware updates that implemented Intel PTT via fw post the Win11 announcement). My full MoBo model is H110M-S2H-CF (U3E1) so if anyone knows for sure its got the fTPM would be nice to know...

It's not major enough to not go ahead if no fTPM, but would mean I'd want/need to install a module sometime after upgrading - hence my question(s) in the first paragraph...

(P.S. I've read through a few threads here, such as If you are going shopping for a TPM 2.0 module, here are some things to know, Windows security, and Changing from firmware TPM to discrete TPM for example to see if there's been much coverage but couldn't see anything notable.)

Appreciate any insights and TIA.

ThrashZone · Jan 19, 2024

Hi,
If you have a bios setting for PTT it's fine
Do you intend on ever using bitlocker if the answer is no don't worry about tpm chips just the bios setting will suffice MS.

Mycenius · Jan 19, 2024

ThrashZone said:
Hi,
If you have a bios setting for PTT it's fine
Do you intend on ever using bitlocker if the answer is no don't worry about tpm chips just the bios setting will suffice MS.

Thanks TZ. I thought it might likely be if its there it's there but then saw the couple of points I made which made me think its possibly not as obvious as it looks.

And Yeah, I am planning on probably enabling bit locker in near future (or an alternative if such a thing is practical) - still researching. I'm pretty security conscious and very active with logon encryption/password management/etc. Been slow to get to the hardware side as my PC gets only limited use last 3-4 years (at least until recently). There's no rush but I am still keen to understand around the TPM modules, as if I am likely to want one eventually (due to the age of my MoBo) I am thinking I'm better getting one now rather than later even if I don't install it for a while...?

ThrashZone · Jan 19, 2024

Hi,
Bios updates are the worst part of PTT I assume but if you know a process it gets easier because if you know your about to wipe you PTT with a bios update you'd prepare and decrypt your drives before.
Once all is done start over.
Having a tpm chip not sure if a bios update would effect that one.

For the record all these items come from China so just try a reputable source which I have none to offer there
I use PTT disabled I have no interest in bitlocker
Maybe a third party but never MS offering.

Mycenius · Jan 20, 2024

ThrashZone said:
Bios updates are the worst part of PTT I assume but if you know a process it gets easier because if you know your about to wipe you PTT with a bios update you'd prepare and decrypt your drives before.
Once all is done start over.
Having a tpm chip not sure if a bios update would effect that one.

Yes - that's a secondary reason I was thinking the discrete TPM chip might be better, especially if in conjunction with drive encryption.

ThrashZone said:
For the record all these items come from China so just try a reputable source which I have none to offer there

Yes I was conscious they are all made in China, and some of the clones/compatibles might simply come out of the same factory as the OEM ones for Gigabyte, ASUS, etc...

ThrashZone said:
I use PTT disabled I have no interest in bitlocker
Maybe a third party but never MS offering.

Yes - certainly part of why I have not rushed to do so. Prefer a reputable third party one.

ThrashZone · Jan 20, 2024

Hi,
Yes I believe support would be best from third party rather than ms
Ever posted on answers.microsoft.com this is as bad as it gets lol

Mycenius · Jan 20, 2024

Mycenius · Jan 20, 2024

ThrashZone said:
Hi,
If you have a bios setting for PTT it's fine

Mycenius said:
Thanks TZ. I thought it might likely be if its there it's there but then saw the couple of points I made which made me think its possibly not as obvious as it looks.

P.S. I just figured out what was going on FWIW and for anyone reading this later - with the last BIOS update I did (basically I jumped from about v5 to v25) it's added and enabled the Intel PTT fTPM (in addition to the TPM hardware option being enabled but no chip module installed), but it obviously didn't fully activate properly for some reason. I disabled it and rebooted then reenabled it and a whole heap of additional status data, etc, showed in the BIOS under Trusted Computing that (wasn't there previously and) is obviously the encrypted virtual fw drive for the PTT.

I then ran my Win 11 Upgrade and it was happy as Larry about the TPM2.0 support now it was properly activated in the BIOS. But still may need to go down the hw module route eventually...

[EDIT] But still keen to hear any one else's thoughts (or real world experience or expertise) on my original question about the substitute chip module reliability?

iko22 · Jan 20, 2024

Mycenius said:
P.S. I just figured out what was going on FWIW and for anyone reading this later - with the last BIOS update I did (basically I jumped from about v5 to v25) it's added and enabled the Intel PTT fTPM (in addition to the TPM hardware option being enabled but no chip module installed), but it obviously didn't fully activate properly for some reason. I disabled it and rebooted then reenabled it and a whole heap of additional status data, etc, showed in the BIOS under Trusted Computing that (wasn't there previously and) is obviously the encrypted virtual fw drive for the PTT.

I then ran my Win 11 Upgrade and it was happy as Larry about the TPM2.0 support now it was properly activated in the BIOS. But still may need to go down the hw module route eventually...

[EDIT] But still keen to hear any one else's thoughts (or real world experience or expertise) on my original question about the substitute chip module reliability?

Hello, I have a compatible TMP module on my motherboard and it is working fine. I bought it because the technology was new to me, and I had heard of people experiencing difficulty in updating BIOS when using fTMP - so I opted for a hardware module instead.
Bought it on Amazon marketplace. The motherboard manufacturers module was out of stock, so I bought this compatible chip, and I have never had any issues with my computer. (I cannot remember the manufacturers name, but it was made in Taiwan, or somewhere in that part of the world.)
It needs setting in BIOS, for the module to take over. In BIOS, the default is always fTMP, even when you have installed a motherboard module. So, you need to override the fTMP in BIOS, for the firmware to find your module. Once you have selected your module in BIOS, then you need to Save your changes, and re-boot the computer, for the changes to take effect. Then after that, you can install Windows 11. Otherwise, you will find yourself installing to fTMP.

Mycenius · Jan 20, 2024

iko22 said:
Hello, I have a compatible TMP module on my motherboard and it is working fine. I bought it because the technology was new to me, and I had heard of people experiencing difficulty in updating BIOS when using fTMP - so I opted for a hardware module instead.
Bought it on Amazon marketplace. The motherboard manufacturers module was out of stock, so I bought this compatible chip, and I have never had any issues with my computer. (I cannot remember the manufacturers name, but it was made in Taiwan, or somewhere in that part of the world.)

Cheers @iko22 I figured that's the case, and in many cases its either (a) the exact same module & chip from the same factory just not sourced through the OEM, or (b) its at least the same chip on a cloned module from another manufacturer. However this obviously may not always be the case and some may just be poorly made or cheap imitations, or more seriously actually compromised or otherwise unsafe. I guess its a case of making sure you get it from as reputable a reseller as possible as there seems little the average person can do to verify if its genuine or not other than visual inspect and then plug it in and see if it works as expected!

iko22 said:
It needs setting in BIOS, for the module to take over. In BIOS, the default is always fTMP, even when you have installed a motherboard module. So, you need to override the fTMP in BIOS, for the firmware to find your module. Once you have selected your module in BIOS, then you need to Save your changes, and re-boot the computer, for the changes to take effect. Then after that, you can install Windows 11. Otherwise, you will find yourself installing to fTMP.

Cheers. I ended up doing my W11 upgrade last night just with the fTPM enabled, while I decide whether to go the module route. I probably will do that, as I do want to eventually encrypt the local drives in my PC, and don't want long-term to deal with the whole fw update to BIOS wipes your encryption keys thing (although as my LGA 1151 socket MoBo is older likely the updates will be quite rare from now on...

I did gather from a previous thread I linked to (Changing from firmware TPM to discrete TPM) its normally not that onerous or difficult to change back and forth between a hardware module TPM 2.0 and a Intel TPP fTPM solution - at least for most people/motherboards...

pseymour · Jan 20, 2024

ThrashZone said:
Bios updates are the worst part of PTT I assume but if you know a process it gets easier because if you know your about to wipe you PTT with a bios update you'd prepare and decrypt your drives before.
Once all is done start over.

You don’t need to decrypt the drive. When we update the BIOS on our encrypted machines, we suspend BitLocker, update BIOS, and resume BitLocker. In fact, we’re a Dell shop, and their BIOS updaters do this for us.