Info Windows 11 info thread

[Colif]

Table of Contents
Types of TPM
WIn 11 Compatible CPU for Intel & AMD
TPM & Win 11 - why its there


Win 11 Insider Discussion

 

[Colif]

Popular types of TPM

• DISCRETE TPM (TPM 1.2 & TPM 2.0)
  Discrete TPM provides the highest level of security. The intent of this level is to ensure that the device it?s protecting does not get hacked via even sophisticated methods. To accomplish this, a discrete chip is designed, built and evaluated for the highest level of security that can resist tampering with the chip, including probing it and freezing it with all sorts of sophisticated attacks.
• INTEGRATED TPM
  Integrated TPM is the next level down in terms of security. This level still has a hardware TPM but it is integrated into a chip that provides functions other than security. The hardware implementation makes it resistant to software bugs, however, this level is not designed to be tamper-resistant.
• FIRMWARE TPM (fTPM)
  Firmware TPM is implemented in protected software. The code runs on the main CPU, so a separate chip is not required. While running like any other program, the code is in a protected execution environment called a trusted execution environment (TEE) that is separated from the rest of the programs that are running on the CPU. By doing this, secrets like private keys that might be needed by the TPM but should not be accessed by others can be kept in the TEE creating a more difficult path for hackers. In addition to the lack of tamper resistance, the downside to the TEE or firmware TPM is that now the TPM is dependent on many additional aspects to keep it secure, including the TEE operating system, bugs in the application code running in the TEE, etc.
• SOFTWARE TPM
  Software TPM can be implemented as a software emulator of the TPM. However, a software TPM is open to many vulnerabilities, not only tampering but also the bugs in any operating system running it. It does have key applications: it is very good for testing or building a system prototype with a TPM in it. For testing purposes, a software TPM could provide the right solution/approach.

Source

many modern cpu can do Firmware TPM so no need for the chip as long as ftpm is an option in the bios

https://docs.microsoft.com/en-us/windows/security/information-protection/tpm/tpm-recommendations

 

[Colif]

Intel CPU support list - https://docs.microsoft.com/en-us/wi...pported/windows-11-supported-intel-processors
AMD CPU support list - https://docs.microsoft.com/en-us/wi...supported/windows-11-supported-amd-processors

 

[Colif]

TPM & Win 11

With Windows 11, we’re making it easier for customers to get protection from these advanced attacks out of the box. All certified Windows 11 systems will come with a TPM 2.0 chip to help ensure customers benefit from security backed by a hardware root-of-trust.

The Trusted Platform Module (TPM) is a chip that is either integrated into your PC’s motherboard or added separately into the CPU. Its purpose is to help protect encryption keys, user credentials, and other sensitive data behind a hardware barrier so that malware and attackers can’t access or tamper with that data.

PCs of the future need this modern hardware root-of-trust to help protect from both common and sophisticated attacks like ransomware and more sophisticated attacks from nation-states. Requiring the TPM 2.0 elevates the standard for hardware security by requiring that built-in root-of-trust.

TPM 2.0 is a critical building block for providing security with Windows Hello and BitLocker to help customers better protect their identities and data. In addition, for many enterprise customers, TPMs help facilitate Zero Trust security by providing a secure element for attesting to the health of devices.

Windows 11 also has out of the box support for Azure-based Microsoft Azure Attestation (MAA) bringing hardware-based Zero Trust to the forefront of security, allowing customers to enforce Zero Trust policies when accessing sensitive resources in the cloud with supported mobile device managements (MDMs) like Intune or on-premises.

https://www.tenforums.com/windows-10-news/181624-windows-11-enables-security-design-chip-cloud.html

source