Monday, June 28th 2021

Certain "Special Purpose Systems" Variants of Windows 11 Ship Without the TPM 2.0 Requirement

Perhaps the most controversial system requirement of the upcoming Windows 11 operating system is the need for a hardware trusted platform module that meets TPM 2.0 specs. Most modern computers fulfill this requirement using fTPM (firmware TPM) solutions built into their processors; and those that don't, have TPM headers for add-on TPMs, which scalpers have their eye on. It turns out, that Microsoft is designing special variants of Windows 11 for special contracts Microsoft will execute.

Computers sold under the scheme will be marked "special purpose systems," and the Windows 11 version running them will do away with the TPM 2.0 requirement. These systems are very likely to be Government or Military; or perhaps even variants Microsoft exports to countries like China and Russia, which have their own specialized cybersecurity policies and dictate software to be written a certain way to be sold in the country.
Source: Tom's Hardware
Add your own comment

30 Comments on Certain "Special Purpose Systems" Variants of Windows 11 Ship Without the TPM 2.0 Requirement

#26
R-T-B
ncrsThe presentation I linked shows very clearly that the chipset hosts ME.
I just went through your pdf. Yes, you are correct. It also says the cpu is 486. Interesting.
ncrsSecurity enclaves, as in SGX? That indeed does live in the CPU, as in the code runs there (the SDK and public info confirms this)
I guess I'm not as up to speed as I used to be, my hats off to you. That would explain the behavior yes and the fact that it's a 486 core for the rest now makes sense that it could live in the chipset.

The binaries were x86_64, interestingly. If so an x86_64 486 is kind of interesting in it's own right but very possible to fit in the PCH since it is not speculative/large.

I need to appologize. I let my pride get ahead of me. My work was mainly dissecting the me partitions from the firmware, unpacking them, and trying to figure out what they did. Clearly I was otherwise unqualified for the level of certainity I presented on this matter. Thanks for the educational pdfs and discourse.
ncrsspeculative execution exploit that managed to break into the ME part.
I do not believe anyone managed more than extraction of SGX secrets. Except maybe on X58. It's old PCH arc core can do some funny things.
ncrsEdit: the entire presentation is very technical, I'll have to watch the recording of it later on, but I'm surprised Intel shared this much publicly.
To be frank, I am too. Aparently sometimes you just have to ask in the right way, I guess.
Posted on Reply
#27
ncrs
R-T-BI just went through your pdf. Yes, you are correct. It also says the cpu is 486. Interesting.

I guess I'm not as up to speed as I used to be, my hats off to you. That would explain the behavior yes and the fact that it's a 486 core for the rest now makes sense that it could live in the chipset.

The binaries were x86_64, interestingly. If so an x86_64 486 is kind of interesting in it's own right but very possible to fit in the PCH since it is not speculative/large.

I need to appologize. I let my pride get ahead of me. My work was mainly dissecting the me partitions from the firmware, unpacking them, and trying to figure out what they did. Clearly I was otherwise unqualified for the level of certainity I presented on this matter. Thanks for the educational pdfs and discourse.
To be completely honest I was not expecting this type of reply, and I am positively surprised (such a rare thing nowadays, sadly). Apology is of course accepted. I am glad we had this discussion as it pushed me to challenge my own state of knowledge as well.
Posted on Reply
#28
Minus Infinity
Well we know which versions will eventually flood the warez sites LOL.
Posted on Reply
#29
c2DDragon
Freak off Microsoft...
/me using Windows 10 and using Microsoft apps on my android smartphone x) )

To be honest I did write to the Asus support to know if I could have a tool or a bios including an option to deal with the PTT because my Asus Maximus Hero VIII doesn't have this option. I'm sad and still waiting for an answer from Asus. I hope they could do something, they are not MSI after all.
Posted on Reply
#30
R-T-B
c2DDragonFreak off Microsoft...
/me using Windows 10 and using Microsoft apps on my android smartphone x) )

To be honest I did write to the Asus support to know if I could have a tool or a bios including an option to deal with the PTT because my Asus Maximus Hero VIII doesn't have this option. I'm sad and still waiting for an answer from Asus. I hope they could do something, they are not MSI after all.
I might be able to help you if that falls through. That board is from an era I am familiar enough with. PM me if all else fails and though I can't promise more than a small looksie timewise, that may be all you need.
Posted on Reply
Add your own comment
Dec 22nd, 2024 03:48 EST change timezone

New Forum Posts

Popular Reviews

Controversial News Posts