Windows 10: Reset TPM keys

aaayush_singh · Jul 6, 2018

After my latest update to windows 10, it shows that I need to reset my TPM keys, my issue is that I have a parallel version of Ubuntu running and right now, as of this moment I have UEFI secure boot enabled and both OS Windows and Ubuntu are UEFI enabled, my query is that if I reset the keys will it effect my Ubuntu Installation?

:)

Sasqui · Jul 6, 2018

Need help on whether to clear TPM on not

Hi there! I'm here because I accidentally downloaded a malware and was suggested to reboot the laptop to get rid of it. I still do want to use the laptop afterwards and I've moved my documents and images onto a seperate device. The programmes i have installed, sadly no. So currently facing the same circumstances and so if the TPM is cleared, does this mean like the activation keys to softwares like MacAfee be cleared? Or like wifi passwords etc. Sorry I'm quite blur hahahahah.
Click to expand...

It's clear as mud. As far as I can tell, it's specific to Windows, not necessarily activated programs like MacAfee, games, etc etc etc. MS Office, I have no idea.

Here's a lengthy doc on it: https://docs.microsoft.com/en-us/wi...initialize-and-configure-ownership-of-the-tpm

Clear all the keys from the TPM
With Windows 10, in most cases, we recommend that you avoid configuring the TPM through TPM.msc. The one exception is that you can use TPM.msc to clear the TPM, for example, as a troubleshooting step, or as a final preparation before a clean installation of a new operating system. Preparing for a clean installation in this way helps ensure that the new operating system can fully deploy any TPM-based functionality that it includes, for example, attestation. However, even if the TPM is not cleared before a new operating system is installed, most TPM functionality will probably work correctly.

Clearing the TPM resets it to an unowned state. After you clear the TPM, the Windows 10 operating system will automatically re-initialize it and take ownership again.
Click to expand...

jboydgolfer · Jul 6, 2018

TPM update

From m$

"The Clear-Tpm cmdlet resets the Trusted Platform Module (TPM) to its default state. A reset removes the owner authorization value and any keys stored in the TPM. To reset a TPM, you must provide a valid owner authorization value. You can enter an owner authorization value or specify a file that contains the value. If you do not provide a value, the cmdlet attempts to use a value stored in the registry."

Best measures would be a backup, or clone, similar type of save.

Look here

Brink · Jul 6, 2018

RSA Keys Generated by Infineon TPMs are Insecure

Lenovo Security Advisory: LEN-15552

Potential Impact: RSA keys generated by the Infineon TPM using certain firmware levels are insecure

Severity: Varies; None to High

Scope of Impact: Industry-Wide

CVE Identifier: CVE-2017-15361

Summary Description:

A vulnerability was identified in the RSA key generation method used by Trusted Platform Modules (TPMs) manufactured by Infineon and contained in some Lenovo products. RSA public keys generated by the Infineon TPM for use by certain software programs should be considered insecure. No TPMs from other manufacturers are affected.

Only software that uses RSA keys generated by the TPM is affected by this vulnerability. No Lenovo-developed software uses the TPM for this purpose. Please see the Infineon advisory located here for more details.

The Trusted Platform Module (TPM) is a microcontroller on the system board used to securely store artifacts used to authenticate the platform, such as passwords, certificates or encryption keys, or measurements to ensure your system is trustworthy.

Mitigation Strategy for Customers (what you should do to protect yourself):

The sequence of steps required to mitigate this issue depends on the application and/or operating of your system. Follow the mitigation instructions provided by your software supplier to avoid data loss when mitigating this issue:

For Microsoft users, follow the procedure located here. Be sure to install the Microsoft patch first in order to determine if your system is affected. If it is affected, then install the TPM Firmware update by following the link in the Product Impact section of this advisory. If you install the TPM firmware update first, the Microsoft tool included in the patch that detects if your system is affected will give incorrect results. For Chromebook users, see the information located here.

Lenovo does not have information for other software that may use the TPM (WinMagic, Linux applications, other Windows applications, etc). To determine what steps should be taken to mitigate this issue (if any) without data loss, you should contact your software supplier.

Some systems in the affected list have 2 TPM’s to allow the user to select between TPM 1.2 and TPM 2.0 (Only one of these TPMs can be active). In the case where the Infineon TPM is not the active TPM, the checking and update tools will indicate the system is not affected. If you change the active TPM at some future date, Lenovo recommends that you re-run the checking and update tools to ensure that the TPM firmware is updated in your new configuration.

Even if you are not currently using any software that uses the TPM, Lenovo recommends that you apply the update contained in the link for your product to prevent generation of weakened keys if you install software that uses the TPM in the future.

Product Impact:
Lenovo is urgently working on qualifying and applying the fixes provided by Infineon on supported systems. Please continue to refer to this advisory to identify fixes as they are posted for your systems.
Click to expand...

Read more: RSA Keys Generated by Infineon TPMs are Insecure

Windows 10: Reset TPM keys

Reset TPM keys

Reset TPM keys

Reset TPM keys

Reset TPM keys - Similar Threads - Reset TPM keys

Computer Reset Clear tpm

Computer Reset Clear tpm

Computer Reset Clear tpm

Require Startup Key with TPM doesn't require TPM. Really?

TPM-Factory Reset

Keyboard not working on TPM reset page

Windows 10, Reset, TPM clear

Prompted either clear the TPM and the keys or just continue and this is after a factory reset

Reset TPM failed, resulting in slow login (have PTT not TPM)

Users found this page by searching for:

kernel security check failure tpm