Trusted Platform Module, daughterboard vs onboard TPM?

Question

In many cases where a Trusted Platform Module (TPM chip) is employed, it is soldered directly onto the motherboard. Ostensibly the motherboard manufacturer is then solely responsible for integrating the BIOS and TPM module, and the overall tamper resistance of the solution.

TPM modules are also available as add-on daughter cards, which plug in to a small 19-pin connector on the motherboard.

From a security perspective, is one solution clearly better or worse than the other? Is there specific functionality one should look for in the BIOS or the TPM module when a daughtercard TPM is used?

Answer 1

A daughter card normally implies it is using a LPC (Low Pin Count) bus. This bus is slow and can relatively easily be monitored/manipulated. This is the basis of the famous TPM reset attack on version 1.1.

1.2 introduced the concept of Locality which mitigate this issue but is said to not entirely prevent it (not proven) - the window of attack is way smaller but the communication is not authenticated.

Not all TPMs are made equal and you get to choose your level of security. While a daughter card would likely not mitigate against the physical reset attack, a lot of new TPMs are integrated within the chipset - since 2009 if I recall. Intel provide those TPMs as part of their vPro technology. They run has application within the Management Engine in the Platform Controller Hub on new architecture or northbridge otherwise. In turn, it means the attack surface is most probably null.

Answer 2

"From a security perspective, is one solution (discrete, integrated, other) clearly better or worse than the other? Is there specific functionality one should look for in the BIOS or the TPM module when a daughtercard TPM is used?"

With TPM 2.0 the separate daughter-card is the highest security level. It is tested in a harness by experts to withstand attack, it can then be plugged into a motherboard where an attack is more difficult; assuming that the operator is not present.

The separate daughter-card used in SuperMicro systems is certified to Evaluation Assurance Level (EAL) 4:

"EAL4 permits a developer to gain maximum assurance from positive security engineering based on good commercial development practices which, though rigorous, do not require substantial specialist knowledge, skills, and other resources. EAL4 is the highest level at which it is likely to be economically feasible to retrofit to an existing product line. EAL4 is therefore applicable in those circumstances where developers or users require a moderate to high level of independently assured security in conventional commodity TOEs and are prepared to incur additional security-specific engineering costs."

Higher security levels involve writing and testing the operating system in addition to providing physical security from sophisticated attacks.

With the level 4 daughter-card theft of the system (or just the drive) still would involve decrypting the data. Even with security, and an encrypted drive, if someone can look over your shoulder or coerce the password from you the information is not secure.

Sources:

• SuperMicro's manual for installing and configuring the discrete TMP: https://www.supermicro.com/manuals/other/TPM.pdf

  That manual gives an idea of what is involved in setting up a TPM, there are relatively few BIOS features; basically on or off for the TPM and any other special security features you may wish to enable.

• https://trustedcomputinggroup.org/wp-content/uploads/2019_TCG_TPM2_BriefOverview_DR02web.pdf

"

1. DISCRETE TPM provides the highest level of security, as might be needed for a TPM used to secure the brake controller in a car. The intent of this level is to ensure that the device it’s protecting does not get hacked via even sophisticated methods. To accomplish this, a discrete chip is designed, built and evaluated for the highest level of security that can resist tampering with the chip, including probing it and freezing it with all sorts of sophisticated attacks.

2. INTEGRATED TPM is the next level down in terms of security. This level still has a hardware TPM but it is integrated into a chip that provides functions other than security. The hardware implementation makes it resistant to software bugs, however, this level is not designed to be tamper-resistant.

3. FIRMWARE TPM is implemented in protected software. The code runs on the main CPU, so a separate chip is not required. While running like any other program, the code is in a protected execution environment called a trusted execution environment (TEE) that is separated from the rest of the programs that are running on the CPU. By doing this, secrets like private keys that might be needed by the TPM but should not be accessed by others can be kept in the TEE creating a more difficult path for hackers.
    
   In addition to the lack of tamper resistance, the downside to the TEE or firmware TPM is that now the TPM is dependent on many additional aspects to keep it secure, including the TEE operating system, bugs in the application code running in the TEE, etc.

4. SOFTWARE TPM can be implemented as a software emulator of the TPM. However, a software TPM is open to many vulnerabilities, not only tampering but also the bugs in any operating system running it. It does have key applications: it is very good for testing or building a system prototype with a TPM in it. For testing purposes, a software TPM could provide the right solution/approach.
   "

Answer 3

The basic idea of the TPM is that it's a hardware-bound identity, meaning it uniquely identifies a single computer. In the PC case, 'computer' means 'motherboard': the TPM needs be integrated into the boot process in a particular way, which requires the cooperation of the BIOS, which lives on the motherboard.

Having a TPM on a daughter card breaks that underlying design assumption: it means a TPM can move between machines, which it's not supposed to be able to do.

Whether that's actually a bad thing... I honestly don't know. It depends on how deeply that assumption is bound up in the design of Trusted Computing protocols. But as someone who's relatively well-versed in TC stuff, putting the thing on a daughter card triggers my 'evil reflex' in a big way.