[ranger_danger]

We know that the PIN method wraps the key in additional layers of encryption, and that the TPM happily returns this wrapped key on boot. So the extra step(s) required would be to bruteforce the PIN and now you can unwrap the plain key.

https://post-cyberlabs.github.io/Offensive-security-publicat...