Solved Why do new motherboards have TPM headers?

Dru2 · Jul 11, 2021

hsehestedt said:
I am told (but have not verified for myself) that when you flash the BIOS on a system using a firmware TPM, you loose the keys and need to supply your recovery key one first reboot after the update. No big deal, just something to be aware of.

As an actual BitLocker user I have also provided actual experience on this many times in this thread.

And yes, when you update the BIOS, upon first boot you will need to verify you are the authorized user of the encrypted drive by providing the BitLocker key or password. The BIOS will then remember this and you won't be asked for the key/password again until the next update or hardware change.

Speaking of which, be aware that certain hardware changes changes like CPU, RAM, MB, or even major BIOS tweaks can cause BitLocker to throw a challenge where you'd need to provide your key or password. Been there done that as well.

Dru2 · Jul 11, 2021

geneo said:
"When installing firmware- or BIOS updates, hardware drivers or when updating the operating system, it is recommended to suspend Bitlocker protection.

In case Bitlocker protection is not suspended before, Bitlocker protection might request a Recovery Key on next boot of the operating system. Root cause is a not validated system integrity at start up."

So you suspend bitlocker, do the update, then enable bitlocker when done.

That is the best approach; though for me, once I enable BitLocker I pretty much forget about it until I'm reminded after doing a BIOS update.

bobkn · Jul 11, 2021

Let me get this straight: a BIOS update erases the Bitlocker key from a firmware TPM? Or not?

(I may never verify this in life. I suppose that I should enable Bitlocker on my laptop, although it rarely leaves the house.)

PerpetualCycle · Jul 11, 2021

bobkn said:
Let me get this straight: a BIOS update erases the Bitlocker key from a firmware TPM? Or not?

(I may never verify this in life. I suppose that I should enable Bitlocker on my laptop, although it rarely leaves the house.)

"Root cause is a not validated system integrity at start up". So I assume not.

bobkn · Jul 11, 2021

ish4d0w said:
(snip)

In Windows 10 , it was an OPTION to encrypt it with the TPM. It is not stored *in* the TPM. The TPM is not a general file storage area but rather a fortified key database.
Having a TPM was not required for using a pin code on windows 10, but is possible that this is part of reasons why a TPM will be required in Windows 11 final version.
It provides much more security in terms of logging in with a pin code, harder to bypass or crack than if it was stored on disk, unencrypted.

I don't follow that. The fTPM does not store the 4 digit Windows PIN? Seems like it would be silly to have the PIN encrypted on the boot drive, with a decryption key on the TPM. The key might take up more space than the PIN.

All that I know for certain is that clearing the PTT on my laptop eliminated the PIN.

tinmar49 · Jul 11, 2021

I have enabled bit locker today as having it appears to be a requirement for W11, the key was put in my Microsoft account, and I wrote it down, it's 36 characters long.
Be wary of buying a TPM module, there is no standard for the connection, so you must buy one that your motherboard is compatible with. I know of at least 3 different header pin combinations, 14, 17 and 20, there might be more.

PerpetualCycle · Jul 11, 2021

Here is a bit on what suspending bitlocker does and when and why it is necesaary

How to suspend BitLocker encryption to perform system changes on Windows 10

Are you using BitLocker encryption? Before trying to update Windows 10, firmware, and hardware, use these steps to avoid issues.

www.windowscentral.com

And from Microsoft docs:

"Suspension of BitLocker does not mean that BitLocker decrypts data on the volume. Instead, suspension makes key used to decrypt the data available to everyone in the clear. New data written to the disk is still encrypted.

While suspended, BitLocker does not validate system integrity at start up. You might suspend BitLocker protection for firmware upgrades or system updates."

You just have to make sure you suspend Bitlocker while making certain updates - otherwise it may interpret the update as an intrusion when it performs a system integrity check at boot, and require the recovery key. In other words has nothing to do with keys.

bobkn · Jul 11, 2021

geneo said:
Here is a bit on what suspending bitlocker does and when and why it is necesaary

How to suspend BitLocker encryption to perform system changes on Windows 10

Are you using BitLocker encryption? Before trying to update Windows 10, firmware, and hardware, use these steps to avoid issues.

www.windowscentral.com

And from Microsoft docs:

"Suspension of BitLocker does not mean that BitLocker decrypts data on the volume. Instead, suspension makes key used to decrypt the data available to everyone in the clear. New data written to the disk is still encrypted.

While suspended, BitLocker does not validate system integrity at start up. You might suspend BitLocker protection for firmware upgrades or system updates."

You just have to make sure you suspend Bitlocker while making certain updates - otherwise it may interpret the update as an intrusion when it performs a system integrity check at boot, and require the recovery key. In other words has nothing to do with keys.

Golly. Is there a simple means of undoing the encryption?

bobkn · Jul 11, 2021

tinmar49 said:
I have enabled bit locker today as having it appears to be a requirement for W11, the key was put in my Microsoft account, and I wrote it down, it's 36 characters long.
Be wary of buying a TPM module, there is no standard for the connection, so you must buy one that your motherboard is compatible with. I know of at least 3 different header pin combinations, 14, 17 and 20, there might be more.

That is the first mention I have ever seen that 11 will require Bitlocker to be active. I'm skeptical. Can you supply a reference? (Having TPM 2.0 is not identical to having Bitlocker active.)

PerpetualCycle · Jul 11, 2021

^ It is not a requirement.

The simple way to decrypt is to disable bitlocker on the drive. It will decrypt (over a long period).

For a desktop, personally I see no point. Unless you are worried that it will be burgled. Wondering if I should use Filevault (MacOS equivalent) on new macbook pro laptop though.

OldMike65 · Jul 11, 2021

bobkn said:
That is the first mention I have ever seen that 11 will require Bitlocker to be active. I'm skeptical. Can you supply a reference? (Having TPM 2.0 is not identical to having Bitlocker active.)

I'm in agreement with you Bob, I know a few folks testing Win 11 right now, its still early beta releases of course, but Bitlocker will not be forced on anyone who does not want to use it. Again having TPM active does not force user to turn on Bitlocker. Or even have to buy a TPM chip for the persons header. Its not necessary to buy this TPM chip for your header IF you don't want too. Win 11 will still install fine, as long as everything else that is required is there. Mainly the proper CPU ....real old ones won't work. Unless you use a VM approach for instance.

Dru2 · Jul 11, 2021

bobkn said:
I don't follow that. The fTPM does not store the 4 digit Windows PIN? Seems like it would be silly to have the PIN encrypted on the boot drive, with a decryption key on the TPM. The key might take up more space than the PIN.

All that I know for certain is that clearing the PTT on my laptop eliminated the PIN.

Laptops are a different creature with their own built-in security features being they're mobile devices. My 2017 Lenovo ThinkPad Yoga X1 gets auto BIOS updates all the time, and yet I've never been required to re-input my BitLocker key. In fact my last BIOS update was 5 July, 2021 and BitLocker is still active and I got nothing asking me to supply a key.

That out the way... all my BitLocker experiences are custom desktops using Intel Gigabyte motherboards. And with that, I'm not going to swear expertise here, but... I believe the BIOS holds a copy of the BitLocker key in the firmware TPM section so that one doesn't need to input the key each and every time the PC boots or restarts. Once a BIOS update is done this info is erased until you input the key again.

As stated you can take a BitLocker drive and place it in another PC and use your BitLocker key or password to unlock it so this says there is also coding embedded on the drive itself.

At least that's the way I understand it along with personal experience of moving drives around as well as constant BIOS updates. Again, desktops using Intel Gigabyte motherboards running Windows 10 Pro (x64).

Here's Microsoft's FAQ's on BitLocker - BitLocker frequently asked questions (FAQ)

PerpetualCycle · Jul 11, 2021

Well I decided not to encrypt My Macbook Pro. It makes little sense. It protects against someone getting separate access to the HDD, but on the Mac, the SSD is integrated on the circuit board - you can't remove it.

ish4d0w · Jul 13, 2021

bobkn said:
I don't follow that.

You definitely should start looking into this, because it seems like TPM is getting a much more prominent role in Windows 11! Also cryptography and security is a very interesting area in my opinion. I did study cryptography at university to some degree, alongside of my main studies and I love it.

A part of these enhancement could be the PIN feature with additional security provided by the TPM (which could be the very reason why they are making it a mandatory system requirement) AND this could possibly extend to ALL passwords and login credentials stored in the computer, that would now be secured by the PIN, that has its encryption key in the TPM.
This way even without Bitlocker you could have better security for the most sensitive information. Just my two cents.

bobkn said:
The fTPM does not store the 4 digit Windows PIN? Seems like it would be silly to have the PIN encrypted on the boot drive, with a decryption key on the TPM. The key might take up more space than the PIN.

All that I know for certain is that clearing the PTT on my laptop eliminated the PIN.

It does not depend on the type of TPM. There is no need to differentiate between regular TPM or onboard, built-in TPM. (fTPM as you call it). Onboard (fTPM) TPM is just like the regular one, except it is not a physically detachable object connected via header but rather built into the chipset or CPU. (depending on model) . Let's just call it TPM for now on for simplicity. But you can apply the same commands to it and it stores keys in a similar manner. From the point of view of the OS, as long as it is version 2.0, there is no difference.
TPM is not a generic storage device, it does not have a "partition" or a "filesystem", none of the usual stuff. It does not work like that and actually it is more space efficient this way. It is a secured fortress serving as a key database. It would be very insecure if one could just place and read files into the TPM.

Like I wrote, in Windows 10, you can use the PIN to log in feature even without a TPM. But if you have TPM, Windows can take advantage of it.

Clearing the TPM (or resetting PTT or security settings) of course invalidates your PIN. It does so even if it does not actually utilize the TPM because any external change to the TPM trips security warnings.
In the case of a TPM reset, it even takes ownership away from Windows along with destroying all data, completely obliterating the existing setup.

But even toggling TPM or PTT on and off (without erasing data or resetting ownership) WILL trip security and invalidate your PIN.

johnlgalt · Jul 13, 2021

Dru2 said:
For the record my experiences with firmware TPM and BitLocker are only with Gigabyte Intel boards. In fact my last 5 boards within an 11-year period have only been Gigabyte. And only Intel. I've never dealt with/built an AMD system.

That said, I'm 99.9 confident my experiences here apply to pretty much any new motherboard supporting Windows 10/11, firmware TPM, and BitLocker.

And, I'm not exactly sure what this means: "Because, also, the current stable UEFI fw also has a different version of the fTPM than the current beta build." Are you talking about a beta BIOS for your board? Also the current "fTPM" should be 2.0 as this is not up to the board vendors.

Intel Platform Trust Technology (PTT): TPM For The Masses

In the last few years, Intel® Platform Trust Technology (PTT) has truly arrived. For years, the last word in securing personal computers, industrial PCs, and servers has been the Trusted Platform Module (TPM) specification. TPM established a set of standards and interfaces that enable system...

www.onlogic.com

Oh, and yes.... I can see where fTPM becomes disabled with a BIOS update since "traditionally" it's usually disabled by default - at least on consumer based motherboards sold to consumers. In fact every board I bought with a UEFI BIOS and fTPM has fTPM disabled by default.

This is also why one needs to review their BIOS/UEFI settings after a BIOS update.

My two cents

Not a different version (as in TPM version) but as in the actual ManufactureVersion:

Code:

PS C:\WINDOWS\system32> get-tpm


TpmPresent                : True
TpmReady                  : True
TpmEnabled                : True
TpmActivated              : True
TpmOwned                  : True
RestartPending            : True
ManufacturerId            : 1095582720
ManufacturerIdTxt         : AMD
ManufacturerVersion       : 3.58.0.5
ManufacturerVersionFull20 : 3.58.0.5

ManagedAuthLevel          : Full
OwnerAuth                 :
OwnerClearDisabled        : False
AutoProvisioning          : Enabled
LockedOut                 : False
LockoutHealTime           : 2 hours
LockoutCount              : 0
LockoutMax                : 32
SelfTest                  : {}



PS C:\WINDOWS\system32>

It was 3.57.0.x before my latest BIOS - and NO it is not a βeta.

MEG X570 GODLIKE | Motherboard | MSI Global

Best AMD AM4 X570 EATX gaming motherboard, lightning PCIe 4.0, five lightning M.2, Frozr Heatsink, Killer LAN, WiFi 6, 6.3mm audio jack, USB 3.2 Gen 2 and Mystic Light , M.2 heatsink, OLED, infinity LED, best overclocking, extended heat-pipe, MSI GAMING

www.msi.com

Latest BIOS came out a few days before the leak, but I took it after reverting from leak to Win10 before taking the first Insiders Dev release.

As for needing to go through UEFI settings - yes, but mistakes can happen if you don't pay attention. I change a lot of things from the default value settings.

hsehestedt said:
I answered this question previously, but a physical TPM module is considered more secure. In addition, I am told (but have not verified for myself) that when you flash the BIOS on a system using a firmware TPM, you loose the keys and need to supply your recovery key one first reboot after the update. No big deal, just something to be aware of.

Yup. This is the link showing it: https://trustedcomputinggroup.org/wp-content/uploads/2019_TCG_TPM2_BriefOverview_DR02web.pdf

geneo said:
I believe that is not the case. firmware TPM is in the chipset. I am sure AMD, Intel and Microsoft has thought this through - loosing keys from a BIOS update would be a big deal. But I did find this:

"When installing firmware- or BIOS updates, hardware drivers or when updating the operating system, it is recommended to suspend Bitlocker protection.

In case Bitlocker protection is not suspended before, Bitlocker protection might request a Recovery Key on next boot of the operating system. Root cause is a not validated system integrity at start up."

So you suspend bitlocker, do the update, then enable bitlocker when done.

Right. But most current BitLocker users probably know this, but if new users start using BL because they have now enabled fTPM / PTT and can use it readily, will they also pay attention to this?

bobkn said:
I don't follow that. The fTPM does not store the 4 digit Windows PIN? Seems like it would be silly to have the PIN encrypted on the boot drive, with a decryption key on the TPM. The key might take up more space than the PIN.

All that I know for certain is that clearing the PTT on my laptop eliminated the PIN.

It seems to for me - every time I've left it off / turned it off (to test in Win 10) / forgotten to turn it back on after a UEFI fw update, I'm asked to create a new PIN because the old PIN is no longer valid.

Dru2 · Jul 13, 2021

johnlgalt said:
As for needing to go through UEFI settings - yes, but mistakes can happen if you don't pay attention. I change a lot of things from the default value settings.

Right. But most current BitLocker users probably know this, but if new users start using BL because they have now enabled fTPM / PTT and can use it readily, will they also pay attention to this?

It seems to for me - every time I've left it off / turned it off (to test in Win 10) / forgotten to turn it back on after a UEFI fw update, I'm asked to create a new PIN because the old PIN is no longer valid.

Point 1 - I can't account for every what if in the universe. If one is going to use a feature they should know what they're doing. BitLocker is a choice, NOT a requirement.

Point 2 - BitLocker is NOT a requirement for Windows 11, TPM/fTPM Is. You do NOT need BitLocker in order to enable/use TPM.

Point 3 - I've said it time and time again, on desktop systems, when you update a BIOS and have BitLocker, you will need to re-input your key so that BitLocker knows you're an authorized user. As an active user of BitLocker, we agree here. I also said some laptops (my 2017 Lenovo) don't issue a BitLocker challenge after a BIOS update because they have their own built in security features.

We're now deep diving into an issue that isn't an issue. Windows 11 requires TPM, not BitLocker.

Peace

OldMike65 · Jul 13, 2021

Dru2 said:
Point 1 - I can't account for every what if in the universe. If one is going to use a feature they should know what they're doing. BitLocker is a choice, NOT a requirement.

Point 2 - BitLocker is NOT a requirement for Windows 11, TPM/fTPM Is. You do NOT need BitLocker in order to enable/use TPM.

Point 3 - I've said it time and time again, on desktop systems, when you update a BIOS and have BitLocker, you will need to re-input your key so that BitLocker knows you're an authorized user. We agree. I also said some laptops (my 2017 Lenovo) don't seem to have this requirement.

We're now deep diving into an issue that isn't an issue. Windows 11 requires TPM, not BitLocker.

Peace

And ...its STILL IN EARLY BETA ...lots of things can change before the final release. :)
And you don't need the actual chip installed ....just turn it on in your bios.

BunnyJ · Jul 13, 2021

Honestly, I don't see MS ditching the TPM 2 requirement that's here to stay and the processor generations are here to stay as well. I just hope that people can use it with the warning on the processor generation. While I understand all of this is for security I wonder if this is overkill.

Dru2 · Jul 13, 2021

OldMike65 said:
And ...its STILL IN EARLY BETA ...lots of things can change before the final release. :)
And you don't need the actual chip installed ....just turn it on in your bios.

Agree on all points

abactuon · Jul 27, 2021

TPM it is a cyber weapon that will be used to encrypt the disks of a potential enemy.

Solved Why do new motherboards have TPM headers?

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Syzygy

My Computers

Well-known member

My Computers

Well-known member

My Computers

Syzygy

My Computers

Well-known member

My Computers

Well-known member

My Computers

Syzygy

My Computers

Well-known member

My Computers

Well-known member

My Computers

Syzygy

My Computers

Well-known member

My Computers

Antidisestablishmentarianist

My Computers

Well-known member

My Computers

Well-known member

My Computers

Python Programmer

My Computer

Well-known member

My Computers

Well-known member

My Computer