TPM control panel?

Hi,

I received an iMac Intel Core Duo and found out that there is a TPM module installed! Being somewhat technically literate, I followed up and read the Trusted Computing Group's specification for this module. It describes in great detail how these can be used for great benefit to enterprises, and system security.
The FAQ ( https://www.trustedcomputinggroup.org/faq/ ) states:

The TCG specification will support privacy principles in a number of ways:

The owner controls personalization.
The owner controls the trust relationship.
The system provides private object storage and digital signature capability.
Private personalization information is never exposed.
Owner keys are encrypted prior to transmission.

I'm curious to know why my iMac did not come with the expected control panel(s) for my oversight on how this device works in my machine. What exactly is Apple doing to protect my privacy? Why don't I 'own' the TPM in my machine?

Thanks in advance for your responses.

sage

iMac Intel Core Duo, Mac OS X (10.4.4)

Posted on Feb 8, 2006 3:52 PM

Reply
6 replies

Feb 8, 2006 4:10 PM in response to Sean Swayze

What's even MORE confusing is why isn't this device listed in the system specifications?
I've done some reading and most people are thinking Apple is doing this to protect OS X from being installed on non-Apple hardware, but this same technology also seems to be preventing me from running other operating systems. As a computer scientist, and network integrator, it's important for me to have this flexibility as well. Can we get some official answers?
This device is clearly not in line with the specification, I think I need help.

Feb 14, 2006 2:59 PM in response to Sean Swayze

Hello Sean,

Apple employees don't read these forums and most of the people here don't have much of an interest in the TPM implementation in the new iMacs. You'll need to contact Apple via an alternative means to get an answer.

FWIW, your iMac is no more likely to grant access to third parties than any previous model.

In what way do you think Apple's TPM implementation is contrary to Canadian law?

Feb 14, 2006 4:46 PM in response to Tobin Richard

Trusted Platform Modules provide a robust set of controls for PCs.
These include a cryptography engine, key storage and remote audit and administration capabilities. With a TPM shipping enabled, it is entirely possible for this remote auditing capability to be utilized. In other vendor's machines TPMs ship disabled by default, and allow the owner/end-user to enable the TPM with the settings that are appropriate to the environment.

Due to the transitive trust nature of the TPM it would provide a remote third party access to the entire system including file system objects given the appropriate trusts. While I'm not suggesting that Apple is using this mechanism for illicit purposes, the frank lack of disclosure is a marked departure from other vendors shipping TPM modules. Worse yet is the lack of user verification tools to ensure the trust settings are in agreement with the security context of the machine.

Furthermore, the Trusted Computing Group has made clear recommendations regarding the use of the TPM module, which Apple has neglected to follow in any respect. This technology is quite new, so people are not yet informed as to its scope.

Microsoft has made it very clear that they intend to use TPM functionality for remote administration via WMI and Group Policy. Independant searching of the major vendors for 'Trusted Platform Module' and then Apple's own site will illustrate my findings in this respect.

As the TPM provides an electronic signature mechanism, PIPEDA legislation states:

48. (1) Subject to subsection (2), the Governor in Council may, on the recommendation of the Treasury Board, make regulations prescribing technologies or processes for the purpose of the definition "secure electronic signature" in subsection 31(1).

Characteristics

(2) The Governor in Council may prescribe a technology or process only if the Governor in Council is satisfied that it can be proved that

(a) the electronic signature resulting from the use by a person of the technology or process is unique to the person;

(b) the use of the technology or process by a person to incorporate, attach or associate the person's electronic signature to an electronic document is under the sole control of the person;

(c) the technology or process can be used to identify the person using the technology or process; and

(d) the electronic signature can be linked with an electronic document in such a way that it can be used to determine whether the electronic document has been changed since the electronic signature was incorporated in, attached to or associated with the electronic document.

While it is the contention of the Trusted Computing Group that the TPM offers no ability for the personal identification of an individual through it's direct control, the underlying transitive trust mechanism provides access to file system objects (data) and as such this data may provide personally identifying information, irrespective of the TPM's internal mechanism.

The real problem is that it offers third party access to a file system. As the TPM is providing an electronic signature functionality, and I am not in control of this mechanism, and further, data is able to be collected through the TPM's transitive trust mechanism, and that this data may be personally identifiable, I contend that this is in direct conflict with the regulations regarding such signatures, and worse, Apple is failing to mitigate the potential third party exposure.

I have made an official complaint to Apple privacy and have as yet had no response. I feel it is important that people understand the true scope of this technology and that Apple should align its practice to other vendors who are implementing the technology according the best practices as recommended by the TCG working group.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

TPM control panel?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.