Windows 10: Do I need to reset the TPM so newly enabled SHA PCR Banks work?

Soda Can1 · Oct 4, 2024

I saw that in my BIOS, under Trusted Computing, there were mutiple SHA PCR Bank options. Only one was enabled by default, SHA-1, however the BIOS had support for other two types of SHA PCR Banks which were SHA-256 and SHA-384.I tried searching high and low for information on these, but the only informative one was from Microsoft Learn and it didn't clarify much about what I wanted to know.So my question is: do I need to reset my TPM key to enable all these three SHA PCR Banks to work? If so or not, what do I need to do to get it to work?By reset, I mean going into tpm.msc and clicking "Clear T

:)

Frick · Oct 4, 2024

Windows 10 devices now requires hardware encryption/TPM

Stolen from Sweclockers, but it's in swedish.

So from now on devices (OEM built) needs a TPM module. Relevant bit:

As of July 28, 2016, all new device models, lines or series must implement and be in compliance with the International Standard ISO/IEC 11889:2015 or the Trusted Computing Group TPM 2.0 Library and a component which implements the TPM 2.0 must be present and enabled by default from this effective date.

The following requirements must be met:

All TPM configurations must comply with local laws and regulations.

Firmware-based components that implement TPM capabilities must implement version 2.0 of the TPM specification.

An EK certificate must either be pre-provisioned to the TPM by the hardware vendor or be capable of being retrieved by the device during the first boot experience.

It must ship with SHA-256 PCR banks and implement PCRs 0 through 23 for SHA-256. Note that it is acceptable to ship TPMs with a single switchable PCR bank that can be utilized for SHA-256 measurements.

It must support TPM2_HMAC command.

A UEFI firmware option to turn off the TPM is not required. OEM systems for special purpose commercial systems, custom order, and customer systems with a custom image are not required to ship with a TPM support enabled.
Click to expand...

Pretty interesting, but there's tons of questions I guess. I don't actually now anything about how TPM works, just that it's hardware, meaning the key is stored in a physical chip and that the decryption has to run through this chip. But I have no idea how let's say biometrics is tied to this. Or what the implications will be, or what exactly is encrypted. The entire storage or just the log in details as such?

Cliff S · Oct 4, 2024

Microsoft Wants Windows 10 Redstone Devices to Be Super Secure

Did it come with Windows 10? No? This only applies to NEW OEM computers that want to have the Windows 10 certified (a sticker).
Click to expand...

Let me expand on this please: This only applies to FUTURE(yet to be made/built) NEW OEM computers that want to have the Windows 10 certified (a sticker).

TPM 2.0 Compliance for Windows 10

Windows 10 for desktop editions (Home, Pro, Enterprise, and Education)

As of July 28, 2016, all new device models, lines or seriesor if you are updating the hardware configuration of a existing model, line or serieswith a major update, such as CPU, graphic cards) must implement and enable by default TPM 2.0 (details in section 3.7, https://msdn.microsoft.com/library/w...(v=vs.85).aspx)Why TPM 2.0?

TPM 2.0 products and systems have important security advantages over TPM 1.2, including:

The TPM 1.2 spec only allows for the use of RSA and the SHA-1 hashing algorithm.

For security reasons, some entities are moving away from SHA-1. Notably, NIST has required many federal agencies to move to SHA-256 as of 2014, and technology leaders, including Microsoft and Google have announced they will remove support for SHA-1 based signing or certificates in 2017.

TPM 2.0 enables greater crypto agility by being more flexible with respect to cryptographic algorithms.

TPM 2.0 supports SHA-256 as well as ECC, the latter being critical to drive signing and key generation performance.

TPM 2.0 achieved ISO standardization (ISO/IEC 11889:2015).

Use of TPM 2.0 may help eliminate the need for OEMs to make exception to standard configurations for certain countries and regions.

TPM 2.0 offers a more consistent experience across different implementations.

TPM 1.2 implementations across both discrete and firmware vary in policy settings. This may result in support issues as lockout policies vary.

TPM 2.0 standardized policy requirement helps establish a consistent lockout experience across devices, as such, Windows can offer a better user experience end to end.

While TPM 1.2 parts were discrete silicon components typically soldered on the motherboard, TPM 2.0 is available both as a discrete (dTPM) silicon component and as a firmware (fTPM) based component running in a trusted execution environment (TEE) on the system’s main SoC:

On Intel chips, it is the Intel Management Engine (ME) or Converged Security Engine (CSE).

For AMD chips, it is the AMD Security Processor

For ARM chips, it is a Trustzone Trusted Application (TA).

In the case of firmware TPM for desktop Windows systems, the chip vendor provides the firmware TPM implementation along with the other chip firmware to OEMs.

Click to expand...

TPM recommendations (Windows 10)

3.7 Trusted Platform Module (TPM)

As of July 28, 2016, all new device models, lines or series must implement and be in compliance with the International Standard ISO/IEC 11889:2015 or the Trusted Computing Group TPM 2.0 Library and a component which implements the TPM 2.0 must be present and enabled by default from this effective date.
The following requirements must be met:

All TPM configurations must comply with local laws and regulations.

Firmware-based components that implement TPM capabilities must implement version 2.0 of the TPM specification.

An EK certificate must either be pre-provisioned to the TPM by the hardware vendor or be capable of being retrieved by the device during the first boot experience.

It must ship with SHA-256 PCR banks and implement PCRs 0 through 23 for SHA-256. Note that it is acceptable to ship TPMs with a single switchable PCR bank that can be utilized for SHA-256 measurements.

It must support TPM2_HMAC command.

A UEFI firmware option to turn off the TPM is not required. OEM systems for special purpose commercial systems, custom order, and customer systems with a custom image are not required to ship with a TPM support enabled.
For detailed TPM information, see Trusted Platform Module topic on TechNet and for TPM 1.2 and 2.0 version comparisons, please reference this article here.2.8 Trusted Platform Module (TPM)

Devices that run Windows 10 Mobile must include a Trusted Platform Module (TPM) that implements version 2.0 of the TPM specification. The TPM can be a firmware-based solution integrated into the SoC or included as a discrete component in the device. The TPM 2.0 must meet the following requirements:

An EK certificate must be either pre-provisioned to the TPM by the hardware vendor or be capable of being retrieved by the device during the first boot experience.

It must ship with SHA-256 PCR banks and implement PCRs 0 through 23 for SHA-256. Note it is acceptable to ship TPMs with a single switchable PCR bank that can be used for both SHA-1 and SHA-256 measurements.

It must support TPM2_HMAC command.

For detailed TPM information, see Trusted Platform Module topic on TechNet.
Click to expand...

Minimum hardware requirements - Windows 10 hardware dev

Lucas Zheng · Oct 4, 2024

How to enable TPM 2.0 on Lenovo M920q Desktop

I've been having a bit of a frustrating experience trying to enable TPM 2.0 on my computer and I'm hoping someone here might be able to provide some insight or guidance. I've already watched several tutorials and read through different articles on how to enable TPM 2.0, but unfortunately, I haven't been able to find the necessary options on my computer to make it work.

Here's a bit more detail about my situation:

System Info:

Operating System: Windows 11

Computer Model: Lenovo M920q Desktop

What I've Tried:

I watched a few YouTube tutorials and followed the steps to enable TPM 2.0 in the BIOS/UEFI settings, but when I accessed those settings, I couldn't find any options related to TPM.

I checked my motherboard's manual to see if there was any specific information about enabling TPM, but unfortunately, there was no mention of it.

I tried looking through Windows settings as well, but couldn't locate any options to enable TPM there either.

I'm beginning to think that my computer might not support TPM 2.0, but I wanted to reach out to this community before coming to any conclusions. Maybe there's something I'm missing or a specific step that I'm not aware of?

If anyone has experience with enabling TPM 2.0 or if you've encountered a similar situation, I'd really appreciate your input. Are there any other avenues I should explore or any additional troubleshooting steps I should take? Or is it possible that some systems simply don't have the capability to enable TPM 2.0?

Thank you in advance for your help.

Windows 10: Do I need to reset the TPM so newly enabled SHA PCR Banks work?

Do I need to reset the TPM so newly enabled SHA PCR Banks work?

Do I need to reset the TPM so newly enabled SHA PCR Banks work?

Do I need to reset the TPM so newly enabled SHA PCR Banks work?

Do I need to reset the TPM so newly enabled SHA PCR Banks work? - Similar Threads - need reset TPM

Do I need to reset the TPM so newly enabled SHA PCR Banks work?

Hi, so I reset my pc and the TPM is gone, I enabled in BIOS but not detected in windows. I...

Hi, so I reset my pc and the TPM is gone, I enabled in BIOS but not detected in windows. I...

Enable TPM

Enable TPM

ENABLE TPM

ENABLE TPM

ENABLE TPM

Enabling TPM