The private key would have to stored in clear text somewhere. Potentially if you had non volatile space on cpu that to store the private key, that might work. But if you’re going to do that, might as well just use an ftpm.
The TPM comes out from the factory with a private key stored in it.
The CPU has the public key.
You turn on the laptop for the first time, and the communication between the CPU and the TPM is encrypted from the start.
That’s what I’m referring to. Can’t this be done? I’m guessing it’s not that easy because I’m sure computer designers have already considered this idea.
The private key would have to stored in clear text somewhere. Potentially if you had non volatile space on cpu that to store the private key, that might work. But if you’re going to do that, might as well just use an ftpm.
Right and not to mention pairing the cpu and tpm for key exchange to avoid mitm attacks…
Why not store it directly in the TPM, if that’s the device that will do that initial decryption?
You can’t do that since vulnerability is the connection between the TPM and the CPU, you need to encrypt that path.
The TPM comes out from the factory with a private key stored in it. The CPU has the public key.
You turn on the laptop for the first time, and the communication between the CPU and the TPM is encrypted from the start.
That’s what I’m referring to. Can’t this be done? I’m guessing it’s not that easy because I’m sure computer designers have already considered this idea.
Pretty sure they meant if you need to keep a persistent public/private pair you can keep them in the tpm and initiate the exchange from there
Just generate one anew. You don’t need to use the same one each time
What do you mean by that? Generate a new private/public key pair every time you setup a new TPM? Or when you boot the system or something?