Encryption Technologies - CompTIA Security+ SY0-701 - 1.4

Trusted Platform Module (TPM) and Hardware Security Module (HSM)

Understanding Trusted Platform Module (TPM)

• The Trusted Platform Module (TPM) is a standardized hardware component designed to provide cryptographic functions for computers, such as generating random numbers or keys.

• TPM features persistent memory, allowing unique keys to be created and securely stored on the machine, which is beneficial for secure key generation like full-disk encryption.

• Keys generated by the TPM can be password protected, making them resistant to brute force or dictionary attacks, thus ensuring device-specific encryption functions.

Transitioning to Hardware Security Modules (HSM)

• For large-scale environments requiring cryptographic functions across many devices, a Hardware Security Module (HSM) is preferred over TPM due to its ability to manage hundreds or thousands of devices.

• HSMs are typically clustered with redundancy in power supplies and network connectivity, ensuring constant access and reliability for secure storage of encryption keys across multiple servers.

Key Management Systems

• Centralized key management systems allow organizations to manage various types of keys from a single console, whether hosted on-premises or in the cloud.

• These systems facilitate automatic key rotation and provide logging/reporting capabilities for tracking key usage across different applications like SSL/TLS and BitLocker.

Data Privacy Challenges

Evolving Data Security Needs

• As data distribution increases across various platforms—laptops, mobile phones—maintaining privacy becomes more complex compared to centralized mainframe systems.

• Continuous evolution in data security is necessary as attackers constantly seek new methods to breach secure data storage solutions.

Secure Enclaves

• A secure enclave is a dedicated security processor integrated into devices that ensures data privacy even if the device falls into unauthorized hands.

Security Features of Modern Devices

Hardware Security and Encryption

• The device includes a true random number generator, enhancing security during the boot process.

• Real-time encryption is performed on all data as it moves in and out of memory, ensuring data integrity and confidentiality.

• Built-in cryptographic keys are immutable, serving as a foundational element for all other cryptography within the system.