 |  |  |
 |
TPM or USB Token: The right tool in the right placeTPM is gaining acceptance as an industry standard for cryptographic hardware connected to computers. But it is often quoted for the wrong applications. TPM, or Trusted Platform Computing, is a chip that is embedded onto a computer's main circuit board. It can encapsulate private keys and allow user space programs to perform calculations on these private keys. Cryptographic tokens (such as an ePass2000) perform a similar task, but as a USB pluggable device. These two forms of crypto-hardware have quite different applications, that should not be confused. The cause of this difference is what the keys bind to -- a TPM device binds to a computer, whereas a USB device binds to its user (who is usually suggested to carry the USB token on his key chain). ExamplesThis makes TPM devices suitable for compter-related keys; for example, to store private keys needed for the server side of HTTPS or SSH protocols. Or to store a private key that expresses a computer-bound license. In all these situations, the key belongs with the computer. An USB token is primarily suited for personal keys. Think of client-side HTTPS certificates or client-side SSH keys for example. These keys can be carried from laptop to desktop and it can only be used with the owner's physical consent. A common TPM misconceptionAn often-heard idea is to use TPM to protect a laptop. This is a bad idea! The main problem with laptops is that they can be stolen. If the laptop contains secrets or otherwise sensitive information, these are lost and leaked. Among the good solutions for laptop theft is encryption of such sensitive information. The last thing you want in that case is that the key to decrypt the information is stolen along with the laptop! A much better solution for the protection of sensitive information, or authentication credentials, on a laptop is to use an external key. While visiting someone, you can leave the laptop in another room but easily take the USB token with you. Just think of making a quick visit to the lavatory and it should be clear -- the laptop stays behind, but a token is quickly pulled out and taken along. Posted on Sun, 10 Jul 2005, 09:03. |
spin-off |  |