Trusted Platform Module / Trusted Computing Platform Alliance (TPM/TCPA) -Guy Macon

I don't agree. There is a very clear concept of TPM ownership. In fact, there is a TCPA primitive precisely to take ownership of the TPM. In order to do this one must supply credentials that are to be used for future authorized TPM commands. He who has access to such credentias can do pretty much whatever he wants with the TPM, including changing such credentials at will.

Looking at the above, I see that I was quite unclear. Sorry about that. Unless I am mistaken, there is no ownership on the level where the system communicates with the TPM chip, alsoknown as the S-CRTM (Static Core Root of Trust for Measurement). I just looked for a list of those lowest-level commands, but did not find it. The Trusted Computing Stack that builds on the lowest level chip *does* have the concept of ownership. Sorry for implying otherwise.

The last time I did anything with a TPM chip, it was with the onboard Random Number Generator, and I must confess that I didn't pay much attention to the other features, but in essence it is a microcontroller with some crypto / hashing algorithms and memory space for keys, and all the rest is done with software that runs on the main CPU.

The ownership is the issue.

TPM is a secured operations system, and ownership of it can be very different from the apparent ownership of the device outside.

Completely false. TPM is a tool that the Operating System can make requests of, the TPM ownership determines if such requests are accepted.

and of

Completely false. It is almost certain that any access of the TPM by linux would be denied by the OS authentication built into the TPM.

That much is true.

This is debatable. There are provisions for hot-swapping the TPM, this is a critical requirement in some server environments.

Here you are confusing the apparent owner of the device, and the owner of execution inside the TPM.

Perfectly false. NGSCB was delayed indefinitely in May 2004, I'm always amazed that such falsehoods persist. Vista has no provisions to make use of a TPM. If you want an OS that does have such abilities, you are looking for MacOS X.

yes. If the owner disables TPM in

Actually, you are wrong here as well. Anything stored by the TPM will either be stored inside the (turned off) TPM and so unavailable, or will be stored encrypted outside the TPM. The correct answer is that anything protected by the TPM will be unavailable when the TPM is turned off.

The TPM is for execution of secure code, the storage of keys is not a major feature.

False. Any accepted OS should have the same access to make computation requests. Any unaccepted OS will not have any access to make computation requests.

It does nothing of the type. If Knoppix is certified as acceptable, then it will have all the access of any other OS. Some TPM chips have additional ability to handle processing that is for that OS only.

False. You clearly have no understanding of even the most basic things that a TPM does.

Can the TPM chip be used for good? Yes, unlike you I don't have to justify it.

The more important question: Can the TPM be used? Sometimes.

I'd suggest you read actually read them as well. BY that I mean actually read them and understand them, not glance through them and attempt to justify your misunderstanding by not understanding what is actually written.

I am always surprised at the simply wrong information around about TPMs, even when people read otherwise accurate information. Joe

What a load of Bullshit.

Totally wrong.

Wrong again. The whole point of TPM is to force the platform to conform to rules someone else sets.

Don't be so arrogantly sure.

I can extract the keys from mswindows from within mswindows and i do not need Knoppix to do it. Though it is handy for recording and crushing and restoring administrator passwords.

Wrong yet again, MS owns mswindows and they are selling the user out.

(TPM/TCPA) _

Some useful links though. Still, you post like an TPM industry shill. The damn thing is a mirage.

Ten years ago such used to surprise me, it does not any more. I have lived and worked with functionally illiterate engineers to much.