Risk
6/25/2008
07:30 PM
50%
50%

A Tipping Point For The Trusted Platform Module?

To achieve widespread adoption, TPM must overcome challenges to encryption key management.

The Trusted Platform Module is a hardware component built into PCs and laptops. It's designed to securely generate and store encryption keys, passwords, and digital certificates. The Trusted Platform Module, or TPM, can be used for a variety of purposes, such as encrypting files and folders and authenticating users, applications, and computers.

According to IDC, nearly 250 million PCs will have shipped with TPM hardware by 2009. In theory, this level of deployment means the module should be the foundation for a variety of useful applications widely embraced by enterprises and individual users. In reality, there are few apps that take advantage of TPM. A major reason is the complexity of managing TPM itself and encryption keys; another may be a lack of awareness of the module and its capabilities.

The Trusted Platform Module is developed by the Trusted Computing Group, a nonprofit organization that designs and develops open specifications for trusted computing. It has approximately 170 members. The module was designed to help organizations protect sensitive information and enable strong authentication for business use and e-commerce transactions. TPM's hardware-based key-generation capabilities make it very secure against many common attacks.

InformationWeek Reports

We'll examine why TPM adoption hasn't matched physical deployments and look at the prospects for wider use of the technology.

A BRIEF HISTORY OF TPM
Along with some IBM research, Microsoft's Trustworthy Computing initiative drove much of the early work in the development of TPM. Along with a number of other practices, Microsoft envisioned the beginnings of a more secure operating environment that included a hardware-based cryptographic root of trust (see story, "TPM: A Matter Of Trust"). Microsoft called this root the Next-Generation Secure Computing Base. The name that many folks knew it as, however, was the internal code name Palladium, after the mythical statue thought to have protected Troy.

Unfortunately for the Trusted Computing Group, Palladium generated a firestorm of negative feedback. Critics argued that Palladium was primarily designed to take control away from the owner of a computer, and privacy rights advocates were riled up over the fact that it was difficult for TPM to allow sufficiently anonymous verifiable transactions. Fortunately, the 1.2 version of the specification has significantly improved the ability for TPM to be used in a way that maintains privacy while still achieving security.

The primary criticism was that one of the stated design goals of TPM is that it could be used to create supposedly unhackable digital rights management systems. DRM technology aims to prevent users from copying and sharing digital content, such as music and movies. Many in the technology community argue that DRM restricts their fair-use rights and pits users against their own computers.

TPM Timeline

(click image for larger view)

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2130
Published: 2015-03-05
Cisco Secure Access Control Server (ACS) provides an unintentional administration web interface based on Apache Tomcat, which allows remote authenticated users to modify application files and configuration files, and consequently execute arbitrary code, by leveraging administrative privileges, aka B...

CVE-2014-9688
Published: 2015-03-05
Unspecified vulnerability in the Ninja Forms plugin before 2.8.10 for WordPress has unknown impact and remote attack vectors related to admin users.

CVE-2015-0598
Published: 2015-03-05
The RADIUS implementation in Cisco IOS and IOS XE allows remote attackers to cause a denial of service (device reload) via crafted IPv6 Attributes in Access-Accept packets, aka Bug IDs CSCur84322 and CSCur27693.

CVE-2015-0607
Published: 2015-03-05
The Authentication Proxy feature in Cisco IOS does not properly handle invalid AAA return codes from RADIUS and TACACS+ servers, which allows remote attackers to bypass authentication in opportunistic circumstances via a connection attempt that triggers an invalid code, as demonstrated by a connecti...

CVE-2015-0657
Published: 2015-03-05
Cisco IOS XR allows remote attackers to cause a denial of service (RSVP process reload) via a malformed RSVP packet, aka Bug ID CSCur69192.

Dark Reading Radio
Archived Dark Reading Radio
How can security professionals better engage with their peers, both in person and online? In this Dark Reading Radio show, we will talk to leaders at some of the security industry’s professional organizations about how security pros can get more involved – with their colleagues in the same industry, with their peers in other industries, and with the IT security community as a whole.