[marginalia_nu]

I don't understand how this stuff prevents me from MITM:ing the attestation and routing requests to another device that is clean and attested? I.e. how do you know that the remote TPM belongs to the device you're talking to?

[mindslight]

The TPM is tamper proof hardware that includes privileged crypto keys that are installed (generated) by the device manufacturer with their identity retained / cataloged. The asymmetry of these privileged keys are where the private/control concerns end up coming from. If these top-level keys were instead unknown to everybody except the device owner (including an enterprise), then there would be no way for a random third party attacker to know whether it was talking to a hardware RPM or a software emulation of one.

[getcrunk]

Same way drm works, it’s going to be in layer of hw/sw that you don’t have control over. We don’t have commonly have control on the cpu, chipset, uefi. And on the top side things like widevine on the application layer