MrChromebox
TPM 2.0 with Cr50
It would be really convenient having automatic LUKS unlocking with TPM on Chromebooks, but it doesn't work rn. Are there plans for it to be implemented?
there's nothing I can do about the fact that the CR50 is not a full TPM 2.0 implementation. I'm not sure if it's sufficient for what you're asking
@MrChromebox https://github.com/tpm2-software/tpm2-tools/issues/3434
Blocker for https://github.com/linuxboot/heads/pull/1658#issuecomment-2136000413 (TPM released Disk Unlock Key: sealing of secret in nvram fails)
@MrChromebox tpm2-software/tpm2-tools#3434
Blocker for linuxboot/heads#1658 (comment) (TPM released Disk Unlock Key: sealing of secret in nvram fails)
@tlaurion CR50 is not a fully TPM 2.0 compliant implementation, as per my comment above. I don't think there's anything missing from the firmware init, other TPM 2.0 chips are fine
@MrChromebox tpm2-software/tpm2-tools#3434
Blocker for linuxboot/heads#1658 (comment) (TPM released Disk Unlock Key: sealing of secret in nvram fails)
@tlaurion CR50 is not a fully TPM 2.0 compliant implementation, as per my comment above. I don't think there's anything missing from the firmware init, other TPM 2.0 chips are fine
https://github.com/tpm2-software/tpm2-tools/issues/3434#issuecomment-2487391586
Two secrets are sealed with same policy, one succeeds (TPM totp with tpm2), where sealing TPM disk unlock key in seperate nvram region fails.
Two logs provided at https://github.com/linuxboot/heads/pull/1658#issuecomment-2136075503
@tlaurion again I'm not sure what I can do from the firmware init side, or even what you're asking for.
@tlaurion again I'm not sure what I can do from the firmware init side, or even what you're asking for.
https://github.com/tpm2-software/tpm2-tools/issues/3434#issuecomment-2489935087
Feature missing from tpm2 implementation, so nothing you can do.
Since the Cr50 is not a full implementation, might it be possible to enable Intel PTT on 8th gen and newer Intel CPUs?
https://www.intel.com/content/www/us/en/support/articles/000094205/processors/intel-core-processors.html
unlike a discrete TPM such as the Cr50 or an Infineon chip on a regular PC, my understaning is PTT exists entirely within the Intel CPU/SoC and no additional chip is needed but it must be enabled in firmware.
Is that something Coreboot / Tianacore could enable?
might it be possible to enable Intel PTT on 8th gen and newer Intel CPUs?
if the PTT was fused off from the factory (as it is on Chromebooks) via the soft straps then there is no way to re-enable it.
Out of curiosity, is cr50 completely incapable from a hardware standpoint? I remember buying an offbrand tpm for my main PC that stated was tpm 2.0 but was actually 1.2, it had no vendor support so I had to resort to some obscure guide to update from 1.2 to 2.0, is that not possible here?
Out of curiosity, is cr50 completely incapable from a hardware standpoint?
it's is 100% capable. there is even a software flag to enable full TPM 2.0 functionality in the CR50 software. But Google builds the CR50 firmware without it, and the CR50 only runs signed Google firmware, so nothing can be done to modify it