On Wed, 11 September 2013 14:47:04 -0400, David Safford wrote: > > But I also think that the existing (certified) TPMs are good enough > for direct use.
That is equivalent to trusting the TPM chip not to be malicious. It requires trusting the chip designer, trusting every single employee of the chip designer, as some of them may be plants from a random countries spook organization, trusting the fab where the chip was manufactured, trusting your local dealer not to replace one chip with another in a similar packaging, trusting third-party components the designers may have incorporated, trusting intermediate steps between designer and fab or fab and local dealer, trusting your own employees, etc. If you sum it all up, you quickly depend on hundreds of people in multiple countries that have the ability to subvert your chips RNG without you being able to notice any difference. Or rather, you would only be able to notice the difference if you were the person that subverted the chip. So the NSA may be able to tell whether the Chinese have subverted a specific chip. Honi soit... Jörn -- "Security vulnerabilities are here to stay." -- Scott Culp, Manager of the Microsoft Security Response Center, 2001 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/