Solved Why do new motherboards have TPM headers?

hsehestedt · Jul 9, 2021

Devlin1888 said:
If you have the header you dont need the module, My mobo has a tpm header at 1.2 which allows the use of firmware tpm to be upgraded to TPM 2.0. Thus i am running TMP 2.0 with a TMP 1.2 header. No module needed

alkaufmann said:
Thanks for that information, but I have still not heard any explanation why there is a TPM header on the motherboard if a TPM module is not required.

It's simple:

A hardware TPM is superior to a firmware TPM. First, it is considered to be more secure, although in the real world I have not heard of anything that has exposed any flaws in the firmware implementation.

Second, I am told by people who have used the firmware version that if a UEFI BIOS update was applied, they had to enter their BitLocker recovery key on the first boot after update in order to access their drive because the update clears the data that would otherwise be stored in the hardware TPM. I can't confirm that because I have not tried it.

In my case, I put together a new system just a couple months ago. It has a FW TPM option but the hardware module was all of $8 so I opted to add it to my system.

hsehestedt · Jul 9, 2021

Dru2 said:
As stated dedicated (discrete) TPM modules will tax a system's resources.

That's a hoax. There is so tiny an amount of data exchanged with the TPM that there is simply no way that it can tax a system's resources.

Dru2 · Jul 9, 2021

hsehestedt said:
That's a hoax. There is so tiny an amount of data exchanged with the TPM that there is simply no way that it can tax a system's resources.

All I know is what I've read and personally experienced. YMMV

Good luck.

johnlgalt · Jul 10, 2021

Dru2 said:
Regarding BIOS updates, BitLocker, and firmware TPM.... as one who uses TPM and updates his BIOS all the time, I can definitively say updating the BIOS does NOT wipe the BitLocker information. If that were the case all one would need to do is update a BIOS to bypass BitLocker.

Looking at an OS BitLocker drive - when you update the BIOS and first boot into the system you will be asked to provide your BitLocker key. Once the key is provided you will be allowed to access the drive and no further BitLocker verifications are subsequently required. If you don't have the key for whatever reason, you won't be able to get into the drive, even if you "revert back" to the original BIOS before the update!

Do keep in mind this is also a security measure because as stated if one wanted to bypass BitLocker all they have to do is update the BIOS. So yes, there is an added danger when updating a BIOS on systems with BitLocker drives. Short fix: Don't lose your key! Been there, done that.

Also, and something to be aware regarding BitLockered drives is you can't just swap them into another machine to bypass the drive encryption because your will still be asked to provide a BitLocker key. Yet another security measure to prevent unauthorized access to an encrypted drive.

fwTPM/TPM and modern day motherboards.... pretty much all motherboards today (and within say the last 10 years) include FW TPM in the BIOS so there's really no need to "buy" a TPM module unless you want added security provided by "discrete" TPM modules, and thus why boards still provide a TPM header.

That said, many already have firmware TPM but don't know it. There are ways to check though; however, if firmware TPM is disabled in the BIOS (and it usually is by default) the typical ways of checking may not work and you would thus have to check the BIOS and enable it. This is where knowing your BIOS comes into play. That said, Brink has a tutorial for an app to check if you have fw_TPM even if it is disabled in the BIOS - Install or Uninstall TPM Diagnostics Tool in Windows 11

Just FYI for all interested.

I wasn't talking about disabling / bypassing - I was talking about rendering the drive permanently locked because the unlock information was gone. And just verifying - you're using firmware TPM exclusively, right?

As for CPU support - you're spot on - I was taking information for Intels TXT and SXM and thinking it actually applied to the use of TPM, but I see where it is a direct access, using the SPI or L2C (which is why you need to know which of those types your hardware module header supports, if you have a hardware header).

Thanks for the heads up.

Dru2 · Jul 10, 2021

johnlgalt said:
And just verifying - you're using firmware TPM exclusively, right?

Yes exclusively only using "firmware TPM" :wink:

johnlgalt · Jul 10, 2021

That is good to know. Because every BIOS update I've thrown at my machine has disabled the fTPM (basically, the UEFI fw update resets all settings to default), so I was worried it was also re-initializing any storage the TPM had.

I may need to throw another instance of Win 11 on a separate physical drive and test whether it does so on my machine - and include testing if reverting to an older UEFI fw makes a difference.

Because, also, the current stable UEFI fw also has a different version of the fTPM than the current beta build.

PerpetualCycle · Jul 10, 2021

Updating BIOS does not reinitialize PTT TPM data. I expect that an Intel Management Engine (aka rebranded as CSME) firmware update does not either. I think they have thought this through :)

Dru2 · Jul 10, 2021

johnlgalt said:
That is good to know. Because every BIOS update I've thrown at my machine has disabled the fTPM (basically, the UEFI fw update resets all settings to default), so I was worried it was also re-initializing any storage the TPM had.

I may need to throw another instance of Win 11 on a separate physical drive and test whether it does so on my machine - and include testing if reverting to an older UEFI fw makes a difference.

Because, also, the current stable UEFI fw also has a different version of the fTPM than the current beta build.

For the record my experiences with firmware TPM and BitLocker are only with Gigabyte Intel boards. In fact my last 5 boards within an 11-year period have only been Gigabyte. And only Intel. I've never dealt with/built an AMD system.

That said, I'm 99.9 confident my experiences here apply to pretty much any new motherboard supporting Windows 10/11, firmware TPM, and BitLocker.

And, I'm not exactly sure what this means: "Because, also, the current stable UEFI fw also has a different version of the fTPM than the current beta build." Are you talking about a beta BIOS for your board? Also the current "fTPM" should be 2.0 as this is not up to the board vendors.

Intel Platform Trust Technology (PTT): TPM For The Masses

In the last few years, Intel® Platform Trust Technology (PTT) has truly arrived. For years, the last word in securing personal computers, industrial PCs, and servers has been the Trusted Platform Module (TPM) specification. TPM established a set of standards and interfaces that enable system...

www.onlogic.com

Oh, and yes.... I can see where fTPM becomes disabled with a BIOS update since "traditionally" it's usually disabled by default - at least on consumer based motherboards sold to consumers. In fact every board I bought with a UEFI BIOS and fTPM has fTPM disabled by default.

This is also why one needs to review their BIOS/UEFI settings after a BIOS update.

My two cents

John Pombrio · Jul 10, 2021

Microsoft made it clear that ANY source of TPM acts the same on the system. It does not matter if it is a chip on the mobo, a TPM module plugged into a mobo header, or firmware on the CPU. Once the security code for TPM is established, Windows uses the same procedure for all three.
That said, I wonder what would happen to a TPM module REMOVED from the mobo when you have something serious, say encrypted Bitlocker drives?

PerpetualCycle · Jul 10, 2021

Dru2 said:
And, I'm not exactly sure what this means: "Because, also, the current stable UEFI fw also has a different version of the fTPM than the current beta build." Are you talking about a beta BIOS for your board? Also the current "fTPM" should be 2.0 as this is not up to the board vendors.

The fTPM firmware implements the TPM 2.0 specification. The TPM firmware itself can have a different version that, for instance, fixes a bug in that implementation. Same goes for Intel PTT and it's TPM.

hsehestedt · Jul 10, 2021

John Pombrio said:
I wonder what would happen to a TPM module REMOVED from the mobo when you have something serious, say encrypted Bitlocker drives?

It's no big deal at all. You Windows will simply need you to supply the recovery key(s) for any bitlocker encrypted drives. Super easy to recover.

Steve C · Jul 11, 2021

alkaufmann said:
I am looking at the Asus ROG Strix Z590-E Gaming Wifi and the ROG Maximus XIII Hero. Just tried to download a manual again and that page is not available, maybe they are updating their manual to include the bios.

If you do not need a TPM-SPI module if it can be handled by the bios and cpu, why is there this TPM header on the motherboard? There has to be some advantage for it or they would save the money and not put that header on the motherboard.

Asus website does show this TPM-SPI module on their website, but have you tried to buy one? Either it is out of stock or you can find it on Ebay for a ridiculous price.

View attachment 2219
I have been very happy with my Maximus VI Hero, maybe I now need to look beyond ASUS.

Ak

I noted Asus often has separate manuals for the motherboard itself and the BIOS

Steve C · Jul 11, 2021

alkaufmann said:
Thanks for that information, but I have still not heard any explanation why there is a TPM header on the motherboard if a TPM module is not required.

Ak

Why not ask Asus support?

Stigg · Jul 11, 2021

It's not just ASUS. GIGABYTE motherboards also have TPM headers.
I suspect that other motherboard makers do too.

hsehestedt · Jul 11, 2021

I answered this question previously, but a physical TPM module is considered more secure. In addition, I am told (but have not verified for myself) that when you flash the BIOS on a system using a firmware TPM, you loose the keys and need to supply your recovery key one first reboot after the update. No big deal, just something to be aware of.

swarfega · Jul 11, 2021

hsehestedt said:
I answered this question previously, but a physical TPM module is considered more secure. In addition, I am told (but have not verified for myself) that when you flash the BIOS on a system using a firmware TPM, you loose the keys and need to supply your recovery key one first reboot after the update. No big deal, just something to be aware of.

Thanks for the headsup. As someone who likes to keep uptodate with the BIOS versions, this could be a downer. I don't use bitlocker though.

PerpetualCycle · Jul 11, 2021

I believe that is not the case. firmware TPM is in the chipset. I am sure AMD, Intel and Microsoft has thought this through - loosing keys from a BIOS update would be a big deal. But I did find this:

"When installing firmware- or BIOS updates, hardware drivers or when updating the operating system, it is recommended to suspend Bitlocker protection.

In case Bitlocker protection is not suspended before, Bitlocker protection might request a Recovery Key on next boot of the operating system. Root cause is a not validated system integrity at start up."

So you suspend bitlocker, do the update, then enable bitlocker when done.

CountMike · Jul 11, 2021

alkaufmann said:
I am looking to upgrade my system for Windows 11 and I don't why the ASUS motherboards I am looking at all have TPM headers for TPM modules that are purchased separately. Then if you search for these TPM modules, you can't find them anywhere. I downloaded the manuals for these motherboards to check out if the bios handles TPM and guess what, the manufacturer has really gotten cheap and the manual has almost no information on the bios.

The main question I would like answered, if a TPM module is not required for Windows 11, why is there a TPM header on the motherboard?

Thanks,
Ak

Well. motherboards are not made for any specific OS and many may need different options. TPM that may be installed one way or other on the MB mostly can't be update but removable one can be changed if needed. In some cases even 2 may be required.

ish4d0w · Jul 11, 2021

bobkn said:
I've never used Bitlocker, but I believe that firmware TPM (Intel PTT, AMF fTPM) supports it.

It does

bobkn said:
One problem with using Bitlocker with a firmware TPM is that if something happens to make the motherboard unusable, the encrypted data are lost. Clearing the firmware TPM also seems likely to lose the data.

This is why it makes you create a Recovery Key, which it can also save to your Microsoft Account, or to an external drive, or print it. With the recovery key, you can unlock the encrypted files without TPM, even on a different computer.

bobkn said:
If you use a physical module, I presume that you could switch it to a new motherboard and preserve the encrypted data. One potential complication is that the new motherboard would have to use the same type of module. There are at least two types (14-1 and 20-1). I don't know whether that's a real issue.

No it does not work like that. This is more than just a physical key, it has security measures. It will not unlock your data if you put it in a different computer.

bobkn said:
I know nothing about Bitlocker.

You should check it out, it's nice!

bobkn said:
One thing I've noticed on my laptop, which has PTT (Intel firmware TPM) enabled by default: the Windows 10 PIN is stored in the TPM. My other Win10 machines have PINs, but the TPM was not enabled.

In Windows 10 , it was an OPTION to encrypt it with the TPM. It is not stored *in* the TPM. The TPM is not a general file storage area but rather a fortified key database.
Having a TPM was not required for using a pin code on windows 10, but is possible that this is part of reasons why a TPM will be required in Windows 11 final version.
It provides much more security in terms of logging in with a pin code, harder to bypass or crack than if it was stored on disk, unencrypted.

jh30uk · Jul 11, 2021

John Pombrio said:
Microsoft made it clear that ANY source of TPM acts the same on the system. It does not matter if it is a chip on the mobo, a TPM module plugged into a mobo header, or firmware on the CPU. Once the security code for TPM is established, Windows uses the same procedure for all three.
That said, I wonder what would happen to a TPM module REMOVED from the mobo when you have something serious, say encrypted Bitlocker drives?

You can back your key up to USB or even print it out if no TPM for Bitlocker.