Windows 10: How to activate TPM in Lenovo device

BRIAN LOFTHOUSE · Sep 9, 2021

After great support from the community a few days ago regarding Windows 11 compatibility checks, I am now trying to find out how to "turn on TPM "in bios ! I have a Lenovo G700 LAPTOP, I have gone into SETTINGS, UPDATE/SECURITY, RECOVERY TROUBLESHOOT etc and then restart. I can see nothing listed in the menu regarding TPM etc. I was a little unsure what to do so came out of it ! Could do with a step by step guide relating to my model ! I went onto the Lenovo helpline but so many questions and serial numbers needed etc. I thought surely there is a easier way!! If TPM is needed for Window

:)

Sasqui · Sep 9, 2021

Need help on whether to clear TPM on not

Hi there! I'm here because I accidentally downloaded a malware and was suggested to reboot the laptop to get rid of it. I still do want to use the laptop afterwards and I've moved my documents and images onto a seperate device. The programmes i have installed, sadly no. So currently facing the same circumstances and so if the TPM is cleared, does this mean like the activation keys to softwares like MacAfee be cleared? Or like wifi passwords etc. Sorry I'm quite blur hahahahah.
Click to expand...

It's clear as mud. As far as I can tell, it's specific to Windows, not necessarily activated programs like MacAfee, games, etc etc etc. MS Office, I have no idea.

Here's a lengthy doc on it: https://docs.microsoft.com/en-us/wi...initialize-and-configure-ownership-of-the-tpm

Clear all the keys from the TPM
With Windows 10, in most cases, we recommend that you avoid configuring the TPM through TPM.msc. The one exception is that you can use TPM.msc to clear the TPM, for example, as a troubleshooting step, or as a final preparation before a clean installation of a new operating system. Preparing for a clean installation in this way helps ensure that the new operating system can fully deploy any TPM-based functionality that it includes, for example, attestation. However, even if the TPM is not cleared before a new operating system is installed, most TPM functionality will probably work correctly.

Clearing the TPM resets it to an unowned state. After you clear the TPM, the Windows 10 operating system will automatically re-initialize it and take ownership again.
Click to expand...

Brink · Sep 9, 2021

RSA Keys Generated by Infineon TPMs are Insecure

Lenovo Security Advisory: LEN-15552

Potential Impact: RSA keys generated by the Infineon TPM using certain firmware levels are insecure

Severity: Varies; None to High

Scope of Impact: Industry-Wide

CVE Identifier: CVE-2017-15361

Summary Description:

A vulnerability was identified in the RSA key generation method used by Trusted Platform Modules (TPMs) manufactured by Infineon and contained in some Lenovo products. RSA public keys generated by the Infineon TPM for use by certain software programs should be considered insecure. No TPMs from other manufacturers are affected.

Only software that uses RSA keys generated by the TPM is affected by this vulnerability. No Lenovo-developed software uses the TPM for this purpose. Please see the Infineon advisory located here for more details.

The Trusted Platform Module (TPM) is a microcontroller on the system board used to securely store artifacts used to authenticate the platform, such as passwords, certificates or encryption keys, or measurements to ensure your system is trustworthy.

Mitigation Strategy for Customers (what you should do to protect yourself):

The sequence of steps required to mitigate this issue depends on the application and/or operating of your system. Follow the mitigation instructions provided by your software supplier to avoid data loss when mitigating this issue:

For Microsoft users, follow the procedure located here. Be sure to install the Microsoft patch first in order to determine if your system is affected. If it is affected, then install the TPM Firmware update by following the link in the Product Impact section of this advisory. If you install the TPM firmware update first, the Microsoft tool included in the patch that detects if your system is affected will give incorrect results. For Chromebook users, see the information located here.

Lenovo does not have information for other software that may use the TPM (WinMagic, Linux applications, other Windows applications, etc). To determine what steps should be taken to mitigate this issue (if any) without data loss, you should contact your software supplier.

Some systems in the affected list have 2 TPM’s to allow the user to select between TPM 1.2 and TPM 2.0 (Only one of these TPMs can be active). In the case where the Infineon TPM is not the active TPM, the checking and update tools will indicate the system is not affected. If you change the active TPM at some future date, Lenovo recommends that you re-run the checking and update tools to ensure that the TPM firmware is updated in your new configuration.

Even if you are not currently using any software that uses the TPM, Lenovo recommends that you apply the update contained in the link for your product to prevent generation of weakened keys if you install software that uses the TPM in the future.

Product Impact:
Lenovo is urgently working on qualifying and applying the fixes provided by Infineon on supported systems. Please continue to refer to this advisory to identify fixes as they are posted for your systems.
Click to expand...

Read more: RSA Keys Generated by Infineon TPMs are Insecure

Frick · Sep 9, 2021

Windows 10 devices now requires hardware encryption/TPM

Stolen from Sweclockers, but it's in swedish.

So from now on devices (OEM built) needs a TPM module. Relevant bit:

As of July 28, 2016, all new device models, lines or series must implement and be in compliance with the International Standard ISO/IEC 11889:2015 or the Trusted Computing Group TPM 2.0 Library and a component which implements the TPM 2.0 must be present and enabled by default from this effective date.

The following requirements must be met:

All TPM configurations must comply with local laws and regulations.

Firmware-based components that implement TPM capabilities must implement version 2.0 of the TPM specification.

An EK certificate must either be pre-provisioned to the TPM by the hardware vendor or be capable of being retrieved by the device during the first boot experience.

It must ship with SHA-256 PCR banks and implement PCRs 0 through 23 for SHA-256. Note that it is acceptable to ship TPMs with a single switchable PCR bank that can be utilized for SHA-256 measurements.

It must support TPM2_HMAC command.

A UEFI firmware option to turn off the TPM is not required. OEM systems for special purpose commercial systems, custom order, and customer systems with a custom image are not required to ship with a TPM support enabled.
Click to expand...

Pretty interesting, but there's tons of questions I guess. I don't actually now anything about how TPM works, just that it's hardware, meaning the key is stored in a physical chip and that the decryption has to run through this chip. But I have no idea how let's say biometrics is tied to this. Or what the implications will be, or what exactly is encrypted. The entire storage or just the log in details as such?

Windows 10: How to activate TPM in Lenovo device

How to activate TPM in Lenovo device

How to activate TPM in Lenovo device

How to activate TPM in Lenovo device

How to activate TPM in Lenovo device - Similar Threads - activate TPM Lenovo

How to enable TPM 2.0 on Lenovo M920q Desktop

How to enable TPM 2.0 on Lenovo M920q Desktop

Alert! TPM device is not detected.

Alert! TPM device is not detected.

Alert! TPM device is not detected.

Windows 11 - How to prepare for a crash of a TPM device

Windows 11 - How to prepare for a crash of a TPM device

Activate TPM !

Alert! TPM device is not detected.