TPM Chipsets Generate Insecure RSA Keys. Multiple Vendors/motherboards Affected; firmware update

[LASER_oneXM]

Infineon TPM chipsets that come with many modern-day motherboards generate insecure RSA encryption keys that put devices at risk of attack.

TPM stands for Trusted Platform Module (TPM), which is an international standard for secure cryptoprocessors that are used to store critical data such as passwords, certificates, and encryption keys.

At the hardware level, TPMs are dedicated microcontrollers that co-exist on the main system board (motherboard) and provide hardware isolation and generate and store artifacts used to authenticate the platform, such as passwords, certificates, or encryption keys.

Vulnerability affects only Infineon TPMs
According to a security alert issued by Infineon last week, a vulnerability in the Infineon TPM firmware results in the generation of RSA keys. Only Infineon TPMs based on the TCG specification family 1.2 and 2.0 are affected.

Infineon is one of the many TPM vendors currently used in production, so not all motherboards are affected.


Infineon issued a firmware update last week and has forwarded the update to motherboard vendors which are now working on integrating the Infineon TPM firmware update into all their products.

Long list of affected vendors

TPMs are typically used in business laptops, routers, embedded and IoT devices. Known affected vendors include Acer, ASUS, Fujitsu, HP, Lenovo, LG, Samsung, Toshiba, and other smaller Chromebook vendors.

"The information in this security bulletin should be acted upon as soon as possible," says HP in a security alert issued today.

"The vulnerability weakens public key resistance against attacks that are used to deduce the corresponding [RSA] private key," said Fujitsu in a similar alert.

"RSA public keys generated by the Infineon TPM for use by certain software programs should be considered insecure," said Lenovo. "Only software that uses RSA keys generated by the TPM is affected by this vulnerability."

The three vendors are working on pushing out firmware updates, and they've published lists of affected products that use Infineon TPMs in their respective advisories.

 

[Deleted member 65228]

The good news is that people are working to resolve the issue and push out a firmware update, instead of it being left vulnerable.