The TPM unseals a key. It is not a typed passphrase

Lesson map

Lesson 11. Map, example, EX057.

flowchart TD
  M["Platform measurements still match"] --> U["TPM unseals the volume key"]
  U --> N["No extra startup passphrase"]
  C["Measurements change"] --> K["Recovery key is demanded"]
  K --> B["Leah recorded no measurement values"]

Unseal on match. Recovery key on mismatch. No values were written down.

Logical drawing

recorded
    TPM used so users do not type an extra startup password
    one older laptop had the TPM off in firmware
    it was enabled with that volunteer's agreement
not recorded
    which FB key that laptop was
    any platform-configuration value
    any firmware version
    any recovery prompt that actually occurred

Learning outcomes

After this chapter, you should be able to:

1. Describe TPM unsealing at the level this case relies on.
2. Keep the unnamed older laptop distinct from FB07.
3. Refuse a measurement log, a firmware version, or a printed recovery key.

11.1 Sealing is conditional release. Enabling a switch is not a measurement log.

Microsoft's BitLocker overview, which this book already cites, describes a TPM mode in which the volume can unlock at startup without the person typing an extra password. The mechanism, stated at the level a defender needs here, is conditional release. The volume key is sealed to platform measurements. When those measurements still match, the TPM unseals the key and the volume opens. When firmware or boot components change, the measurements change, unsealing fails, and BitLocker asks for the recovery key. Chapter 3 gives the operational form of that fact: a firmware update or a hardware change can make BitLocker ask. The food bank therefore keeps the recovery key off the laptop, which the next chapter takes up. This chapter's limit is what was not measured.

Leah checks that a TPM is enabled, turns BitLocker on, and confirms later that encryption shows as on and protection shows as active. She also records that one older laptop had its TPM switched off in firmware settings. With that volunteer's agreement, she enables it first. The manuscript does not give that laptop a short name. FB07 is the unique worst row of the quick check, and chapter 4 later calls FB07 the kind of old laptop the replacement note is about. Those are different sentences. Joining them into "FB07 was the laptop whose TPM was off" adds an identifier the text does not contain. No platform-configuration-register value is written. No firmware version is written. No recovery prompt is recorded as having happened. A prompt remains a consequence the design must plan for, not an event in the log.

NIST SP 800-147 discusses protection of the BIOS update path. NIST SP 800-193 discusses firmware resiliency: protect, detect, and recover. A hardware root of trust is an assumption about a component, not a screenshot of its setup screen. That enablement is not a recorded golden measurement, and it is not evidence that the firmware update mechanism was reviewed. SP 800-53's SI-7 names integrity of software and firmware in the catalog. Fenwick has no SI-7 result. Because no operating-system version is printed, a reader also cannot infer which measurement set a particular BitLocker release would have used. Guessing the indices would pretend to a log that was never taken.

11.2 Worked example

Lesson table; scroll horizontally to read all columns →

Synthetic case. No recovery key and no firmware version are printed.

Errors and limits

A root of trust is only as useful as the measurements you actually kept. This file kept none of the measurement values.

Apply

• EX057 — What was recorded? The book says one older laptop had its TPM off, that it was enabled with agreement, and that a later firmware change can demand the recovery key. Which further facts are you allowed to add?
  Show marking criteria

  Rubric: 3 = none of the tempting ones; no FB id for that laptop, no register value, no firmware version, no recovery prompt, and no printed key; FB07 stays the worst quick-check row without becoming that unnamed laptop;; 2 = the blanks stay blank;; 1 = one blank filled;; 0 = none.