TPM是什么？
TPM（可信平台模块）用于提高电脑的安全性。 BitLocker 硬盘加密、Windows Hello 等服务都使用它来安全地创建和存储加密密钥，并确认设备上的操作系统和固件是正确的，没有被篡改。
虽然 TPM 2.0 标准允许英特尔或 AMD 等制造商在其芯片组中内置 TPM 功能，而不需要单独的芯片，但它通常是主板上的一个独立芯片。
TPM 已经存在了 20 多年，从 2005 年左右开始成为个人电脑的一部分。2016 年，TPM 2.0 版本（本文撰写时的当前版本）成为新个人电脑的标准配置。
A TPM (Trusted Platform Module) is used to improve the security of your PC. It's used by services like BitLocker drive encryption, Windows Hello, and others, to securely create and store cryptographic keys, and to confirm that the operating system and firmware on your device are what they're supposed to be, and haven't been tampered with.
Typically, it's a separate chip on the motherboard though the TPM 2.0 standard allows manufacturers like Intel or AMD to build the TPM capability into their chipsets rather than requiring a separate chip.
TPM has been around for over 20 years, and has been part of PCs since around 2005. In 2016 TPM version 2.0 - the current version as of this writing - became standard in new PCs.
What's a cryptographic key? 什么是加密密钥？
当你需要加密数据防止别人窥探时，加密软件将您要加密的数据与一长串随机字符结合起来，形成新的加密数据。加密软件使用的随机长字符串就是加密密钥。
注：未加密的数据称为 "明文"。该数据的加密版本称为 "密文"。
加密后，只有拥有正确加密密钥的人才能解密并读取原始数据。
When you encrypt something to protect it from prying eyes the encryption software takes the piece of data you want to encrypt and combines it with a long, random string of characters to form a new, encrypted, piece of data. The long, random string of characters used by the encryption software is the cryptographic key.
Note: The unencrypted data is called the "plaintext". The encrypted version of that data is called the "ciphertext".
Once it's encrypted, only somebody with the correct cryptographic key can decrypt it and read the original piece of data.
Does my PC already have TPM? 我的电脑是否已经包含 TPM？
您的电脑很有可能已经安装了 TPM，如果电脑的机龄不到 5 年，就应该安装了 TPM 2.0。
要了解您的 Windows 10 电脑是否已经拥有 TPM，请访问 "开始" > "设置" > "更新和安全" > "Windows 安全" > "设备安全"。如果有，您会在屏幕上看到安全处理器部分。
The odds are that your PC does already have TPM, and if it's less than 5 years old you should have TPM 2.0.
To find out if your Windows 10 PC already has it go to Start > Settings > Update and Security > Windows Security > Device Security. If you have it, you'll see a Security processor section on the screen.
提示：如果看不到安全处理器部分，可能是你的设备有 TPM，但 TPM 已关闭。要了解如何打开，请参阅在 PC 上启用 TPM 2.0。( 在 PC 上启用 TPM 2.0 - Microsoft 支持)
下一步是找出电脑的 TPM 版本。选择 "安全处理器详细信息"，在出现的屏幕上查找规范版本。上面应该显示 "1.2 "或 "2.0"。
重要：Windows 11 要求 TPM 版本为 2.0。有关详细信息，请参阅 Windows 11 系统要求。( Windows 11 系统要求 - Microsoft 支持)
Tip: If you don't see the Security processor section it may be that your device has TPM but that the TPM is turned off. To learn how to turn it on see Enable TPM 2.0 on your PC. ( Enable TPM 2.0 on your PC - Microsoft Support)
The next step is to find out what version of TPM your PC has. Select Security processor details and on the screen that appears you're looking for the Specification version. It should say either "1.2" or "2.0".
Important: Windows 11 requires TPM version 2.0. For more information see Windows 11 System Requirements. ( Windows 11 System Requirements - Microsoft Support)
TPM RNG是什么？
TPM RNG代表"Trusted Platform Module Random Number Generator"，是计算机安全领域中的术语。它是指在Trusted Platform Module（TPM）芯片中内置的随机数生成器。TPM是一种硬件安全模块，旨在提供计算机系统的安全支持，包括加密、密钥管理、认证等功能。
随机数生成器（RNG）是一个用于生成随机数或伪随机数序列的工具。在计算机安全中，随机数具有重要意义，用于生成加密密钥、认证令牌、安全随机数等，以增加系统的安全性。TPM中的随机数生成器被设计为一种硬件级别的安全资源，其目标是提供高质量的随机数，以抵御各种攻击，包括预测和猜测攻击。
TPM RNG通过收集硬件噪声、环境噪声等源来生成随机性。这些源包括微小的电子波动、温度变化、电磁干扰等，这些都是难以预测的因素，可以用来生成相对较强的随机数序列。这些随机数可以用于生成密码学密钥，确保安全通信和数据保护。
总之，TPM RNG是Trusted Platform Module芯片中的随机数生成器，用于提供计算机系统中的安全随机数，以增强系统的安全性和隐私保护。
参考：
1，Microsoft
What is TPM? - Microsoft Support
受信任的平台模块技术概述 - Windows Security | Microsoft Learn
2，Tencent
TPM RNG是什么？- 腾讯云开发者社区-腾讯云 (tencent.com)
3，TPM library
TPM 2.0 Library | Trusted Computing Group
4，TPM 2.0规范由微软提供的实现
5，基于tmp.dev网站的Tutorial
GitHub - tpm2dev/tpm.dev.tutorials: Tutorials from TPM.dev members
6，Linux TPM tool
Linux TPM2 & TSS2 Software · GitHub
7，OpenSecurityTraining
https://opensecuritytraining.info/IntroToTrustedComputing_files/Day1-4-tpm101.pdf
2866
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
