Risk
6/25/2008
07:30 PM
Connect Directly
RSS
E-Mail
50%
50%
Repost This

A Tipping Point For The Trusted Platform Module?

To achieve widespread adoption, TPM must overcome challenges to encryption key management.

The Trusted Platform Module is a hardware component built into PCs and laptops. It's designed to securely generate and store encryption keys, passwords, and digital certificates. The Trusted Platform Module, or TPM, can be used for a variety of purposes, such as encrypting files and folders and authenticating users, applications, and computers.

According to IDC, nearly 250 million PCs will have shipped with TPM hardware by 2009. In theory, this level of deployment means the module should be the foundation for a variety of useful applications widely embraced by enterprises and individual users. In reality, there are few apps that take advantage of TPM. A major reason is the complexity of managing TPM itself and encryption keys; another may be a lack of awareness of the module and its capabilities.

The Trusted Platform Module is developed by the Trusted Computing Group, a nonprofit organization that designs and develops open specifications for trusted computing. It has approximately 170 members. The module was designed to help organizations protect sensitive information and enable strong authentication for business use and e-commerce transactions. TPM's hardware-based key-generation capabilities make it very secure against many common attacks.

InformationWeek Reports

We'll examine why TPM adoption hasn't matched physical deployments and look at the prospects for wider use of the technology.

A BRIEF HISTORY OF TPM
Along with some IBM research, Microsoft's Trustworthy Computing initiative drove much of the early work in the development of TPM. Along with a number of other practices, Microsoft envisioned the beginnings of a more secure operating environment that included a hardware-based cryptographic root of trust (see story, "TPM: A Matter Of Trust"). Microsoft called this root the Next-Generation Secure Computing Base. The name that many folks knew it as, however, was the internal code name Palladium, after the mythical statue thought to have protected Troy.

Unfortunately for the Trusted Computing Group, Palladium generated a firestorm of negative feedback. Critics argued that Palladium was primarily designed to take control away from the owner of a computer, and privacy rights advocates were riled up over the fact that it was difficult for TPM to allow sufficiently anonymous verifiable transactions. Fortunately, the 1.2 version of the specification has significantly improved the ability for TPM to be used in a way that maintains privacy while still achieving security.

The primary criticism was that one of the stated design goals of TPM is that it could be used to create supposedly unhackable digital rights management systems. DRM technology aims to prevent users from copying and sharing digital content, such as music and movies. Many in the technology community argue that DRM restricts their fair-use rights and pits users against their own computers.

TPM Timeline

(click image for larger view)

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-1421
Published: 2014-04-22
Cross-site scripting (XSS) vulnerability in Craig Knudsen WebCalendar before 1.2.5, 1.2.6, and other versions before 1.2.7 allows remote attackers to inject arbitrary web script or HTML via the Category Name field to category.php.

CVE-2013-2105
Published: 2014-04-22
The Show In Browser (show_in_browser) gem 0.0.3 for Ruby allows local users to inject arbitrary web script or HTML via a symlink attack on /tmp/browser.html.

CVE-2013-2187
Published: 2014-04-22
Cross-site scripting (XSS) vulnerability in Apache Archiva 1.2 through 1.2.2 and 1.3 before 1.3.8 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters, related to the home page.

CVE-2013-4116
Published: 2014-04-22
lib/npm.js in Node Packaged Modules (npm) before 1.3.3 allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names that are created when unpacking archives.

CVE-2013-4472
Published: 2014-04-22
The openTempFile function in goo/gfile.cc in Xpdf and Poppler 0.24.3 and earlier, when running on a system other than Unix, allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names.

Best of the Web