> For the complete documentation index, see [llms.txt](https://chunhthanhde.gitbook.io/google-learning-programs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://chunhthanhde.gitbook.io/google-learning-programs/google-it-support-professional-certificate/course-5-it-security-defense-against-the-digital-dark-arts/module-2-pelcgbybtl-cryptology/4.cryptography-applications/5.cryptographic-hardware.md).

# Cryptographic Hardware 🛡️🔑

## **Trusted Platform Module (TPM)** 🖥️🔒

* **Overview**:
  * A hardware device integrated into a computer to provide a dedicated crypto processor.
  * Offers secure key generation, random number generation, remote attestation, and data binding and sealing.
* **Functions**:
  * **Hardware Authentication**: Detects unauthorized hardware changes.
  * **Remote Attestation**: Allows a system to authenticate its software and hardware configuration to a remote system by generating a secure hash using a unique RSA key.
  * **Data Binding and Sealing**:
    * **Data Binding**: Encrypts data using a unique key derived from the TPM's secret key, binding it to the TPM and the system.
    * **Data Sealing**: Encrypts data with a hardware-backed key, requiring the TPM to be in a specific state for decryption.
* **Implementations**:
  * **Discrete Chip**: Most secure, includes physical tamper resistance.
  * **Integrated Chip**: Embedded in other chips.
  * **Firmware/Software**: Virtualized in a hypervisor.

## **Secure Elements (SE)** 📱🔒

* **Overview**:
  * Tamper-resistant chips found in mobile devices, either embedded in the microprocessor or integrated into the main board.
  * Provides secure storage for cryptographic keys and a secure environment for applications.
* **Evolution**:
  * **Trusted Execution Environment (TEE)**: An advanced secure environment running alongside the main OS, isolating applications and secure processes.

## **Criticism and Vulnerabilities** ⚠️🔧

* **Manufacturing Trust**: TPMs may have their secret keys accessible to the manufacturer at the time of production, posing a potential risk.
* **Physical Attacks**: Advanced attacks, like those requiring electron microscopes, can potentially access TPM contents, although such attacks are highly specialized and time-consuming.

## **Full Disk Encryption (FDE)** 💾🔒

* **Concept**:
  * Encrypts the entire drive, not just specific files, to protect against data theft or tampering.
  * Requires an unencrypted boot partition to load the OS and prompt for a passphrase to unlock the encrypted disk.
* **Implementations**:
  * **PGP**: Commercial product.
  * **BitLocker**: Microsoft's solution, integrates with TPM.
  * **FileVault 2**: Apple's solution.
  * **dm-crypt**: Open-source for Linux systems.
* **Integration with TPM**:
  * Uses TPM encryption keys to secure the disk and ensure platform integrity, preventing unlocking if the system configuration changes.

## **Random Number Generation** 🎲🔢

* **Importance**:
  * Critical for encryption systems; non-random or predictable numbers can compromise security.
* **Types**:
  * **True Random**: Generated from unpredictable physical processes.
  * **Pseudorandom**: Generated algorithmically but should be seeded from a true random source.
* **Entropy Pool**:
  * Maintained by operating systems to seed random number generators.
  * Dedicated hardware or software generators ensure cryptographic keys are produced with high randomness.

Understanding these cryptographic hardware concepts helps in implementing robust security measures to protect data integrity and confidentiality. 🌐🔐