BIOS/UEFI Lesson 004: Trusted Platform Module (TPM) and Hardware Security Module (HSM)

Hardware Root of Trust (HRoT)

Cryptographic firmware module embedded in a computer system that endorses trusted execution and attests to boot settings and metrics.

What is a hardware root of trust (HRoT) used for?

For scanning the boot metrics in the OS files. The RoT then sends a report to the processor as a RoT certificate.

Where is the HRoT (Hardware Root of Trust firmware stored?

On a dedicated module or chip in ROM.

Trusted Platform Module (TPM)

A specification for hardware based storage of digital certificates, keys, password hashes, and other user and platform identification information.

Endorsement Key (EK)

The microprocessor that is hard-coded with a unique, and unchangeable key for each trusted platform module (TPM).

What does the TPM provide?

Key generation and storage, random number generation, and secure storage of encryption keys.

What does the TPM ensure concerning the UEFI?

That the UEFI has not been tampered with.

How can TPM be managed in Windows?

Through the tpm.msc console or through group policy.

Hardware Security Module (HSM)

An appliance for generating and storing cryptographic keys that are less susceptible to tampering and insider threats, rather than using less secure storage device solutions.

What are hardware security modules (HSMs) used for?

Used to protect systems using encryption paths, which is more secure than a regular password or key.

How does a HSM provide security?

By using a trusted and protected digital key that can be used with an encryption device.

What is one of the primary things that makes HSMs more secure than a regular password?

They are automated, so they cannot be compromised due to human involvement.

How are HSMs physically used?

By either installing a module into a system, on a rack mount, wirelessly, or with a specialized USB flash drive.