Hacker News new | ask | show | jobs
by marklar423 962 days ago
That's pretty interesting. I wonder if replacing the signing keys could help negate DRM-y uses of the TPM
1 comments

Doubtful. TPM chips come pre loaded with signing keys from the manufacturer. That allows 3rd parties to verify that an attestation made by your TPM is genuine. (They can do that by checking signatures all the way back to the manufacturer’s public cert).

If you replace the manufacturer’s signing keys with some keys you generated yourself, the only real effect is that your computer can no longer do remote attestations. So you can no longer convince any 3rd parties that your computer is operating in a “secure” mode.