Instructor: In this lesson,
we're going to talk about the Trusted Platform Module or TPM
and the hardware security module or HSM
that exists as part of your UEFI.
But first, I want to introduce you
to the hardware Root of Trust, known as the RoT.
Now a hardware Root of Trust is the foundation
on which all secure operations of a computing system depend.
It contains the keys used for cryptographic functions
and enables a secure boot process.
This is inherently trusted
and therefore it must be secure by design.
Now a Hardware Root of Trust
is a cryptographic module embedded within a computer system
that can endorse trusted execution
and attest to the boot settings and metrics.
This may sound like a complicated concept
but you use a Root of Trust all the time.
In fact, the TPM module inside your computer's UEFI
is a hardware Root of Trust.
Essentially, a Root of Trust is going to be used
to scan the boot metrics to the system
and the operating system files.
And then the Root of Trust
can send over a report to the processor
that's digitally signed using the Root of Trust certificate
to indicate that they can be trusted.
Essentially, this hardware Root of Trust
is a digital certificate,
but it's embedded inside of your chip
as part of the firmware on your system.
Now the most commonly used hardware Root of Trust
is the Trusted Platform Module or TPM
that exists within your computer.
The TPM is a specification for hardware-based storage
of digital certificates, keys, password hashes,
and other user and platform identification information.
Each TPM microprocessor is hard-coded
with a unique and unchangeable key
that's referred to as the endorsement key or EK.
Your system is going to use this TPM and its key
to ensure the system firmware, boot loader, and OS kernel
have not been tampered with or modified
by using multiple different functions
performed within the Trusted Platform Module.
First, the TPM provides a secure method of input and output.
Second, there is a cryptographic processor within it
that provides a true random number generator.
The TPM also has an RSA key generator,
a SHA-1 hash generator,
and both an encryption and decryption signature engine.
In addition to all of that,
the TPM also has a persistent memory
that contains a digital key known as the endorsement key
and a storage root key known as the SRK.
Now the TPM also has a versatile memory
that's located within it and this includes
the Platform Configuration Registers or PCRs,
the Attestation Identity Keys or AIKs
and the storage keys.
Now that is a lot of functionality
within that one little TPM chip.
So you're probably wondering, do I have to memorize
all of these different things for the exam?
Well the good news is no, you don't,
but I wanted to introduce you to this concept
because you're going to see it again and again
as you continue upward in your IT and cybersecurity career.
Instead, for the exam,
I really just need you to remember
that the Trusted Platform Module or TPM
is a hardware Root of Trust
and that it's part of your system.
And it's going to allow you to have the ability to ensure that
when your system is being booted up,
it's being done securely,
because this TPM is attesting to the fact
that our UEFI has not been modified or tampered with
and that TPM can also be used to provide encryption
for your storage devices.
Yes, this is yet another function of the TPM,
because it can be used as the secret key
in conjunction with the full-disk encryption on a system
to protect the contents of your storage device.
For example, if you're using BitLocker
with full-disk encryption on a Windows system,
it's actually using the key inside of your TPM
to make sure the data on your storage device
remains securely encrypted.
The TPM can be enabled or disabled
from within your UEFI configuration tool
or you can manage it using tools
within the operating system,
if your operating system does support that.
For example, the Windows operating system
does allow you to manage the TPM
using the tpm.msc console tool within Windows,
or if you're using Windows Server environment,
you can modify it using the Group Policy Editor.
Now for the exam,
you do not need to know how to modify or configure the TPM,
but in the real world, as a technician,
you may be asked to work with the Trusted Platform Module.
If you are, you can always look up
the latest documentation at microsoft.com
for how to modify and configure the TPM properly.
Another form of hardware Root of Trust
that we have to look at
is known as the hardware security module or HSM.
Now a hardware security module is an appliance
for generating and storing cryptographic keys
that is less susceptible to tampering and insider threats
than using storage-based solutions.
Now hardware security modules
are used to protect our systems using encryption pass,
because they are much more secure
than using a traditional password or secret key.
Instead, a hardware security module
contains a trusted and protected digital key
that can be used with an encryption device.
There are many different ways
to create hardware security modules,
and they are produced in different form factors as well.
For example, here on the screen,
you can see the nCipher hardware security module
and it has three different models here.
There is one that is an internal card
that can be put inside of your system,
there is one that's a rack mounted system,
and then there's one,
that's more of an Internet of things type of solution.
The real advantage of these types of systems
is that they are automated,
and that means that the keys cannot be compromised
by human involvement.
By removing the person from the equation,
we can have better security for our systems
and ensure they're more secure.
Another form of hardware security module
is a device that looks like a USB thumb drive or flash drive
that can contain a digital key
that's used to encrypt a hard drive or other storage device.
Then, to decrypt and read that drive,
you would need to insert the HSM into the system,
have that digital key read and verified,
and then the storage device could be decrypted.
This is actually a very common way of encrypting hard drives
before the Trusted Platform Module was commonly included
as part of our modern computers.