WinMagic has supported TPM (at pre-boot) since 2005. Starting with Infineon TPM v1.1, we now support Infineon v1.2 and the Broadcom chipset. We are currently working on support for the Atmel chips. While in theory TPM v1.2 of all vendors are supposed to work the same way and support the same (low level) application programming interface API, it is unfortunately not always the case.
I would like to outline our view on the TPM to hopefully clarify some points: 1) Symmetric AES 256 bit is considered much "stronger" than RSA's asymmetric keys of 1024 bits. I recall NIST would put the same strength to AES 256-bit at 15,000 bit RSA. Thus, TPM with 2048 bit RSA does not provide higher security (to AES 256 bit keys). (See Table 2: Comparable Strengths in <http://csrc.nist.gov/publications/nistpubs/800-57/SP800-57-Part1.pdf> http://csrc.nist.gov/publications/nistpubs/800-57/SP800-57-Part1.pdf) 2) Use of TPM in conjunction with Full Disk Encryption should refer mainly to the ability to get a secret from the TPM to have the key to access the disk data. 3) Due to the fact that all applications can use the root private key of the TPM, the key management in conjunction with TPM public key system is different to, for example, smartcard and PKI for disk encryption. 4) Managing TPM keys and using TPM to protect disk encryption key are two different issues. As a disk encryption vendor, we would not need to "manage" TPM keys. Similarly to using PKI, our software does not manage PKI keys or change any keys on the smartcard. Unlike PKI though, our software has to use a TPM key slot. But this should not interfere with other keys. 5) For data recovery, our key servers can issue keys to access encrypted disks even if the TPM is for some reasons no longer available. This is essential whether or not we can manage TPM keys. And I would like to refer to our point 1) above to emphasize that the ability to work without TPM does not necessarily mean the encryption system is weakened. So, the TPM is a very welcome addition to the PC to increase the security level of the encryption systems and it can eliminate the weakest link of the encryption system: the password. WinMagic - as far as we know - is the only Full Disk Encryption vendor to support TPM in the real sense of disk encryption: to get the disk encryption key, at pre-boot. And this TPM support for FDE does not necessarily mean the software has to manage TPM keys. On behalf of our CEO - Thi Nguyen-Huu. Cheers, Joseph _____ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Brian Wood Sent: Saturday, August 18, 2007 4:27 PM To: [email protected] Subject: Re: [FDE] New DoD encryption mandate and TPM requirements Saqib, I am new to this list, but have worked in the field for some time, and I want to make a point here: the TPM keys are a core security component of this particular FDE solution. That means that the management of those keys needs to be handled by the approved security software, not something else. By saying that Wave could handle the backup/restore/transfer of keys, you are saying that a non-approved piece of software (Wave in this case) will have control over the keys which are used to secure all the data. That is an unacceptable risk for any security solution, to allow another program to manage your encryption keys in any way. While this works for something like the Wave/Seagate partnership, primarily because Seagate provides no management software at all, this is not going to be acceptable for a managed software solution, whether it be Mobile Armor, WinMagic or Pointsec. That software must provide the security and management of the software keys used for encryption. While they may rely on TPM for local storage and physical protection of the keys on the end device, reliance on what would essentially be a third-party solution for backup of those keys would not be acceptable. A main criteria whenever a disk encryption solution is chosen, whether by the government or a corporation, is the safe, secure and known management of all keys, including backup and recovery. If Mobile Armor or anybody went into a sale and said "by the way, you need to buy this other package over which we have no control to backup and manage the keys from the local computers", no one would buy the product. Realize also that this does not mean that Wave could not partner or license their technology for integration into someones solution and acquire a large business in that fashion, but as a direct player at this time in the DARTT market, they would not benefit at this time. Brian Wood Ali, Saqib wrote: Wave's solution will not benefit by this, because it does not manage any of the DARTT selected software. Bryan, I think you are missing the point. If a encryption suite (e.g. MobileArmor) is using the TPM to "Wrap/Bind" the bulk data encryption keys then the Wavesys does NOT need to manage the encryption suite. The Wavesys has to simply provide management of the TPM with key backup/restore and transfer capabilities. Wavesys is not designed to managed encryption software. It doesn't have to. If the encryption software properly utilizes the TPM, then the Wavesys only needs to manage the TPM. saqib http://www.linkedin.com/in/encryption _______________________________________________ FDE mailing list [email protected] http://www.xml-dev.com/mailman/listinfo/fde
_______________________________________________ FDE mailing list [email protected] http://www.xml-dev.com/mailman/listinfo/fde
