Windows 10: TPM Module for Gigabyte Motherboard

My 2012 Gigabyte GA-Z77X-UD5H motherboard has a 20 pin TPM slot as shown below. Gigabyte advise the slot is for a v1.0 TPM module. It's unclear whether I need a bespoke Gigabyte TPM module or whether any 20 pin v1.0 TPM will work. I don't plan to use Bitlocker. In that case, what extra system security does the TPM provide? Will there be a problem accessing my data if there s ever a problem with the TPM module?

:)

 

Verify Trusted Platform Module (TPM) Chip on Windows PC


Something I came across not long ago, is Firmware-based Trusted Platform Modules (fTPM). Whereas before in order to take advantage of a TPM you needed to have a physical TPM chip soldered to the motherboard, that seems to have changed at some point. You can now have either a Discrete TPM (Physical chip) or Firmware-based TPM.

As per THIS article, fTPM is acknowledged by the Trusted Computing Group (TCG) as a perfectly valid form of TPM and seems to perform much the same functions as a physical TPM. For Intel, their fTPM is called Intel Platform Trust Technology (PTT). I don't know what chips/motherboards/BIOS support PTT, however due to it being Firmware based (as the name suggests) and not requiring a separate physical chip, it means for some devices it's possible to retrospectively add a TPM to devices that didn't have one before.

Looking through the Intel NUC list, it's not just 6th gen Skylake NUC's that it's supported on, but also 5th gen Broadwell NUC's and 4th gen Haswell NUC's too. So if you have a NUC and you have the latest BIOS, then the chances are you have a TPM 2.0 module even if you didn't think you did. You just need to enable 'Intel Platform Trust Technology' in BIOS. As previously mentioned, I don't know what other manufacturers support/will support fTPM too.


The Intel Platform Trust Technology (PTT) setting in Intel VisualBIOS:





With Intel PTT on in BIOS, Device Manager and tpm.msc show a TPM 2.0 module installed.

 

Infineon TPM Modules generating insecure RSA Keys


FYI...

I get emails for updates for my Lenovo ThinkPad notebook. That said, I got one this morning alerting me that some Lenovo notebooks using Infineon TPM modules are generating insecure RSA keys - RSA Keys Generated by Infineon TPMs are Insecure

Anyway, the link above lists affected notebooks; how to check your module; how get the firmware update. You can tell the updater to check the firmware before updating. Turns out I have a STMicro module, not an Infineon so I'm good....





For those running TMP modules, you can check the model and version by typing "tpm.msc" (without quotes) in the Run command. In the center panel, near bottom you should see TPM Manufacturer Information. It should list Manufacturer Name, Manufacturer Version, and Specification Version. Infineon modules will be listed as IFX under Manufacturer Name.

Edit: Asked Brink to post in News forums. Done.

 

Initialisation of the Trusted Platform Module (TPM) failed

I'm not finding any specific issues on Win 10 1909, but ironically, there are a couple of known TPM issues on 2004.

If you do upgrade to 2004, I would suggest installing the currently available Cumulative Update Preview KB457144.

From the list of fixes there are 2 TPM related issues addressed:

1) Addresses an issue that causes communication with the TPM to time out and fail.

2) Addresses an issue that prevents hash signing from working correctly when using the Microsoft Platform Crypto Provider for Trusted Platform Modules (TPM). This issue might also affect networking software, such as virtual private network (VPN) applications.

Resources:

KB4571744 release notes:

https://support.microsoft.com/en-us/...date-kb4571744

You can download the preview release here:

https://www.catalog.update.microsoft...px?q=kb4571744

EDIT: If you prefer, you can also download that preview cumulative update by going into the updates section of settings and choosing the option called "View optional updates".