[SOLVED] Trusted Platform Module

[idigweeds]

I ran the W11 system check to see if W11 could run on my systems. It tells me that I need a more recent CPU and needs a Trusted Platform Module. Question is, is the TPU part of the motherboard or the CPU? Is it hardware, firmware, OS, driver or software?

 

[USAFRet]

I ran the W11 system check to see if W11 could run on my systems. It tells me that I need a more recent CPU and needs a Trusted Platform Module. Question is, is the TPU part of the motherboard or the CPU? Is it hardware, firmware, OS, driver or software?

1. It is hardware. A physical module (mostly) On some systems, there is potential way to fake it
2. What are your hardware specs?
3. Patience. If MS really requires this TPM thing, they are shooting themselves in the foot for Upgrade numbers for Win 11.

 

[ex_bubblehead]

I'm still researching and things are changing on a minute to minute basis, but it looks like the TPM requirement is here to stay. However, TPM 1.2 is the required base level with 2.0 being preferred. In addition it looks like anyone running an older CPU will be out of luck. This isn't going to make the userbase happy at all.

 

[mact]

The <Mod Edit> is going to settle shortly after the first of the year coming.<G>

Neither of my i7 2600K (Brutus) nor 3770K (Bruno) systems seem to "meet spec" but my AMD 3700X (Newbox) does.

But I'll bet they'll be able to run it quite well once it lands and is sorted. If not, well I use XP, W7, and W10 plus W11 on the Newbox AM4 system doesn't add much.<G>

I was concerned a new system might be needed. So far, NOPE. The AMD is top of the heap for now.

Am thinking about bumping the AMD from 3700X to 3950X, but the cost is high and as a non-gamer I can't see any real advantage in doing so since quite a bit of my work is done in XP via VirtualBox with old apps.

So long as VirtualBox can run on W11 I'll be happy enough.

 

[digitalgriffin]

Some of these make zero sense...

AMD 2700 is supported but 1700 isn't? 3400g supported. 2400g isn't?

Once you throw in support for Ryzen+ you should get support for Ryzen entire lineup. They are the same chip but on a different process node. 14 glofo vs 12 tsmc.

Support only goes back to 8 gen core. Not sure I get that either.

I think Microsoft will get a very low adoption rate. People aren't going to be too happy being forced to update with small performance gains from gen 2 Intel to gen 11.

I mean a 2700k sandy bridge @ 4.6Ghz is about 40% slower. But it's still decent for gaming. My 3770k is still going strong at 4.4GHz for my younger sons gaming PC.

I wonder if all this tpm and modern architecture stuff is to avoid side channel attacks and the like.

 

[Colif]

Win 11 List of Supported AMD processors

I do know that if a Motherboard has a hardware TPM port you don't need to have fTPM via CPU to run that feature. But if a Motherboard doesn't have a TPM Port then you will need to use fTPM via CPU to run that feature.

https://community.amd.com/t5/processors/does-the-ryzen-processor-line-support-tpm/td-p/114611
in above case changing bios version got it working, so it is possible that future bios updates may make boards that don't work suddenly work.

https://docs.microsoft.com/en-us/windows/security/information-protection/tpm/tpm-recommendations

Popular types of TPM

• DISCRETE TPM (TPM 1.2 & TPM 2.0)
  Discrete TPM provides the highest level of security. The intent of this level is to ensure that the device it?s protecting does not get hacked via even sophisticated methods. To accomplish this, a discrete chip is designed, built and evaluated for the highest level of security that can resist tampering with the chip, including probing it and freezing it with all sorts of sophisticated attacks.
• INTEGRATED TPM
  Integrated TPM is the next level down in terms of security. This level still has a hardware TPM but it is integrated into a chip that provides functions other than security. The hardware implementation makes it resistant to software bugs, however, this level is not designed to be tamper-resistant.
• FIRMWARE TPM (fTPM)
  Firmware TPM is implemented in protected software. The code runs on the main CPU, so a separate chip is not required. While running like any other program, the code is in a protected execution environment called a trusted execution environment (TEE) that is separated from the rest of the programs that are running on the CPU. By doing this, secrets like private keys that might be needed by the TPM but should not be accessed by others can be kept in the TEE creating a more difficult path for hackers. In addition to the lack of tamper resistance, the downside to the TEE or firmware TPM is that now the TPM is dependent on many additional aspects to keep it secure, including the TEE operating system, bugs in the application code running in the TEE, etc.
• SOFTWARE TPM
  Software TPM can be implemented as a software emulator of the TPM. However, a software TPM is open to many vulnerabilities, not only tampering but also the bugs in any operating system running it. It does have key applications: it is very good for testing or building a system prototype with a TPM in it. For testing purposes, a software TPM could provide the right solution/approach.

https://aps2.support.emea.dynabook.com/kb0/TSB8B03XO0000R01.htm

 

[idigweeds]

I'm still researching and things are changing on a minute to minute basis, but it looks like the TPM requirement is here to stay. However, TPM 1.2 is the required base level with 2.0 being preferred. In addition it looks like anyone running an older CPU will be out of luck. This isn't going to make the userbase happy at all.

This user is decidedly unhappy. I have 4 fully functional Windows 10 pcs in my house, and not one is upgradeable to Windows 11. I have no budget to replace even one of them, at least anytime soon.

I'm hoping to eventually swap out parts of my workhorse desktop PC, but I need to educate myself on the current technology. I actually assembled the one I hope to upgrade, so I'm not a total noob at this.

 

[idigweeds]

1. It is hardware. A physical module (mostly) On some systems, there is potential way to fake it
2. What are your hardware specs?
3. Patience. If MS really requires this TPM thing, they are shooting themselves in the foot for Upgrade numbers for Win 11.

Would it be safe to say that if I buy a Windows 11 supported CPU, it, or the MB I have to buy to put it on, would have a current TPU 2.0? So far, I cant even find a MB that has TPM mentioned in the specs listed on a store's sales page.

 

[USAFRet]

Would it be safe to say that if I buy a Windows 11 supported CPU, it, or the MB I have to buy to put it on, would have a current TPU 2.0? So far, I cant even find a MB that has TPM mentioned in the specs listed on a store's sales page.

It would be safe to reconsider this question at the end of this year, when Win 11 is actually released and much more is known.

 

[Colif]

tpm feels like what MS did with driver signatures. It warned hardware makers it was going to turn it on and many ignored it until suddenly, drivers needed signatures to work with win 10, and many had to scramble to get their win 7 drivers signed to work with 10. Now its TPM, and I expect if MS don't change, many hardware makers will release fixes before its out so their customers aren't taking up pitchforks and storming their offices

 

[Joseph_138]

The <Mod Edit> is going to settle shortly after the first of the year coming.<G>

Neither of my i7 2600K (Brutus) nor 3770K (Bruno) systems seem to "meet spec" but my AMD 3700X (Newbox) does.

But I'll bet they'll be able to run it quite well once it lands and is sorted. If not, well I use XP, W7, and W10 plus W11 on the Newbox AM4 system doesn't add much.<G>

I was concerned a new system might be needed. So far, NOPE. The AMD is top of the heap for now.

Am thinking about bumping the AMD from 3700X to 3950X, but the cost is high and as a non-gamer I can't see any real advantage in doing so since quite a bit of my work is done in XP via VirtualBox with old apps.

So long as VirtualBox can run on W11 I'll be happy enough.

I expect someone will figure out a way to bypass the installer hardware checks to make it work on unsupported hardware that supports TPM 2.0. That's the only thing that the installer checks for that I don't see a simple way to bypass.

 

[mact]

either that or someone will finger out a way to add a TPM module to an 1155 mobo.

 

[Endre]

I’d say that the Windows 11 requirements: TPM 2.0/ DirectX 12/ UEFI BIOS/ 64-bit new gen. CPU/ exist because Microsoft no longer wants to deal with old hardware.

There comes a time, when the tech industry must move forward.

People with old PCs can still run their apps on Windows 10 until 2025.
But if a user wants the “latest & greatest” in terms of MS OS, then new hardware is required.
I don’t see that as abnormal.

 

[SoumithCS]

In my opinion I would never install and run W11 on any PC. I would suggest to run it on any 7th or 8th gen i5-xxxx laptops. Since most laptops have TPM provided and fixed to the mobo by the manufacturers themselves. If you really want to try it on PC then use VM softwares, or just run it remotely via Unraid. Laptops are most preferable to run W11 during early access since any malware or security breaches can be easily terminated and they are easy to format. Presently I am running W11 on a Acer Aspire laptop with a included TPM (IDK version) with Core i5-8250u and 8gb ram with secure boot disable (Secure boot bugs out W11 from loading and makes it to reboot loop in my case).

 

[SoumithCS]

Currently AsRock has a TPM chip module selling on Amazon but it is compatible only with AsRock mobos. Other sell it too at higher cost.

 

[Colif]

UEFI is hardly new, been around since 2009. Anyone with a pc older than that should stay on win 10 if they can get on it now.

There always comes a time new OS aren't an option for an old PC, that has always been the case... its not new. I never put my vista PC on Win 8 as I knew it wouldn't work well.

Some of the restrictions are harsh for users, when hardware makers basically ignored things MS said they wanted in Win 10 PC and now they require them its like, but 5 years isn't enough time. Talk about shifting the problem onto the consumer and play blame games with each other.