## Chapter 11 — The TPM unseals a key. It is not a typed passphrase ### Lesson map Lesson 11. Map, example, EX057. ```mermaid flowchart TD M["Platform measurements still match"] --> U["TPM unseals the volume key"] U --> N["No extra startup passphrase"] C["Measurements change"] --> K["Recovery key is demanded"] K --> B["Leah recorded no measurement values"] ``` Unseal on match. Recovery key on mismatch. No values were written down. ### Logical drawing ```text recorded TPM used so users do not type an extra startup password one older laptop had the TPM off in firmware it was enabled with that volunteer's agreement not recorded which FB key that laptop was any platform-configuration value any firmware version any recovery prompt that actually occurred ``` ### Learning outcomes After this chapter, you should be able to: 1. Describe TPM unsealing at the level this case relies on. 2. Keep the unnamed older laptop distinct from `FB07`. 3. Refuse a measurement log, a firmware version, or a printed recovery key. ### 11.1 Sealing is conditional release. Enabling a switch is not a measurement log. Microsoft's BitLocker overview, which this book already cites, describes a TPM mode in which the volume can unlock at startup without the person typing an extra password. The mechanism, stated at the level a defender needs here, is conditional release. The volume key is sealed to platform measurements. When those measurements still match, the TPM unseals the key and the volume opens. When firmware or boot components change, the measurements change, unsealing fails, and BitLocker asks for the recovery key. Chapter 3 gives the operational form of that fact: a firmware update or a hardware change can make BitLocker ask. The food bank therefore keeps the recovery key off the laptop, which the next chapter takes up. This chapter's limit is what was not measured. Leah checks that a TPM is enabled, turns BitLocker on, and confirms later that encryption shows as on and protection shows as active. She also records that one older laptop had its TPM switched off in firmware settings. With that volunteer's agreement, she enables it first. The manuscript does not give that laptop a short name. `FB07` is the unique worst row of the quick check, and chapter 4 later calls `FB07` the kind of old laptop the replacement note is about. Those are different sentences. Joining them into "`FB07` was the laptop whose TPM was off" adds an identifier the text does not contain. No platform-configuration-register value is written. No firmware version is written. No recovery prompt is recorded as having happened. A prompt remains a consequence the design must plan for, not an event in the log. NIST SP 800-147 discusses protection of the BIOS update path. NIST SP 800-193 discusses firmware resiliency: protect, detect, and recover. A hardware root of trust is an assumption about a component, not a screenshot of its setup screen. That enablement is not a recorded golden measurement, and it is not evidence that the firmware update mechanism was reviewed. SP 800-53's SI-7 names integrity of software and firmware in the catalog. Fenwick has no SI-7 result. Because no operating-system version is printed, a reader also cannot infer which measurement set a particular BitLocker release would have used. Guessing the indices would pretend to a log that was never taken. ### 11.2 Worked example | Detail | Status in the file | Decision | |---|---|---| | "TPM mode avoids an extra startup password." | Chapter 3 and the BitLocker overview | May stay | | "A measurement change can demand the recovery key." | The case states the consequence | May stay | | "The older laptop's short name is FB07." | The short name is not given | Refuse | | "A platform-configuration register was saved as known-good." | No register value is in the file | Refuse | > **Synthetic case.** No recovery key and no firmware version are printed. ### Errors and limits A root of trust is only as useful as the measurements you actually kept. This file kept none of the measurement values. ### Apply - **EX057 — What was recorded?** The book says one older laptop had its TPM off, that it was enabled with agreement, and that a later firmware change can demand the recovery key. Which further facts are you allowed to add? *Rubric:* 3 = none of the tempting ones; no FB id for that laptop, no register value, no firmware version, no recovery prompt, and no printed key; FB07 stays the worst quick-check row without becoming that unnamed laptop;; 2 = the blanks stay blank;; 1 = one blank filled;; 0 = none. ### Continue studying — lesson 11 (chapter 11 of 20) [← Chapter 10](#ch-10) · [Course chapter index](../SUBJECTS.md) · [Chapter 12 →](#ch-12) Continue to the next authored lesson. ## Worked answers **EX057.** No further facts of that kind. The older laptop stays unnamed, FB07 stays the worst row without absorbing it, and no register value, firmware version, recovery prompt or printed key is added.