this post was submitted on 07 Feb 2024
738 points (97.7% liked)
Technology
59092 readers
4744 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Why not store it directly in the TPM, if that's the device that will do that initial decryption?
You can't do that since vulnerability is the connection between the TPM and the CPU, you need to encrypt that path.
The TPM comes out from the factory with a private key stored in it. The CPU has the public key.
You turn on the laptop for the first time, and the communication between the CPU and the TPM is encrypted from the start.
That's what I'm referring to. Can't this be done? I'm guessing it's not that easy because I'm sure computer designers have already considered this idea.
Pretty sure they meant if you need to keep a persistent public/private pair you can keep them in the tpm and initiate the exchange from there
That's correct. I'm guessing if it hasn't been implemented yet, then there is some technical roadblock I'm currently missing.