Currently there's a lot of talk about Windows 11 and the requirement for
TPM 2.0.

I have no intention of installing Windows 11, but I was wondering about
my own TPM status, since I always got a message saying "error
communicating with TPM chip" when I booted up Mint. I have always
ignored this error because it didn't seem to have any impact whatsoever.

So out of curiosity I enabled TPM on my machine (it was called TXT in my
BIOS - Trusted Execution Technology), and indeed the error went away.

Then after reading a bit more about TPM and "trusted computing"
(especially a lot of criticism), I decided I do not really want it, so I
disabled it again in my BIOS. Strangely enough, the error when booting
Mint didn't come back, so Mint apparently did find a way to communicate
with it now, even though it's disabled again.

Is it a good idea to enable TPM in Mint? Does Mint ever use it? Or is it
best to leave it disabled?

NP2 wrote:
> I enabled TPM on my machine (it was called TXT in my BIOS - Trusted
> Execution Technology), and indeed the error went away.

The article in the wp is very extensive incl TPM2 and TXT and linux.

https://en.wikipedia.org/wiki/Trusted_Platform_Module

It also lists a mailing list which is also accessible by nntp, see the
section named Linux-Integrity Archive on lore.kernel.org at
https://lore.kernel.org/linux-integrity/

--
Mike Easter

On 6/27/21 10:27 AM, NP2 wrote:
> Currently there's a lot of talk about Windows 11 and the requirement
> for TPM 2.0.
>
> I have no intention of installing Windows 11, but I was wondering
> about my own TPM status, since I always got a message saying "error
> communicating with TPM chip" when I booted up Mint. I have always
> ignored this error because it didn't seem to have any impact whatsoever.
>
> So out of curiosity I enabled TPM on my machine (it was called TXT in
> my BIOS - Trusted Execution Technology), and indeed the error went away.
>
> Then after reading a bit more about TPM and "trusted computing"
> (especially a lot of criticism), I decided I do not really want it, so
> I disabled it again in my BIOS. Strangely enough, the error when
> booting Mint didn't come back, so Mint apparently did find a way to
> communicate with it now, even though it's disabled again.
>
> Is it a good idea to enable TPM in Mint? Does Mint ever use it? Or is
> it best to leave it disabled?

It appears to be something that Intel cooked up-

https://www.intel.com/content/www/us/en/support/articles/000025873/technologies.html

*What is Intel® Trusted Execution Technology (Intel® TXT)?*

Intel® Trusted Execution Technology
<https://www.intel.com/content/www/us/en/data-security/security-overview-general-technology.html>
is a set of hardware extensions to Intel® processors and chipsets that
enhance the digital office platform with security capabilities such as
measured launch and protected execution. Intel Trusted Execution
Technology provides hardware-based mechanisms that help protect against
software-based attacks and protects the confidentiality and integrity of
data stored or created on the client PC.

Intel Trusted Execution Technology provides these mechanisms by enabling
an environment where applications can run within their own
space—protected from all other software on the system. These
capabilities provide the protection mechanisms, rooted in hardware, that
are necessary to provide trust in the application's execution
environment. In turn, these mechanisms can protect vital data and
processes from being compromised by malicious software running on the
platform.

If using an AMD processor does it have relevance?

Mike Easter wrote:
> The article in the wp is very extensive incl TPM2 and TXT and linux.

I think I like the Arch wiki better
https://wiki.archlinux.org/title/Trusted_Platform_Module

It refers to an old 2016 article that is also useful
https://lwn.net/Articles/674751/

--
Mike Easter

NP2 wrote:

> Is it a good idea to enable TPM in Mint? Does Mint ever use it? Or is it
> best to leave it disabled?

It appears I was mistaken. It's actually GRUB that communicates with the
TPM chip, not Mint.

https://www.gnu.org/software/grub/manual/grub/html_node/Measured-Boot.html

NP2 wrote:
> NP2 wrote:
>
>> Is it a good idea to enable TPM in Mint? Does Mint ever use it? Or is
>> it best to leave it disabled?
>
> It appears I was mistaken. It's actually GRUB that communicates with the
> TPM chip, not Mint.
>
> https://www.gnu.org/software/grub/manual/grub/html_node/Measured-Boot.html
>
How can I turn TPM off or disable it in Ubuntu? - Ask Ubuntu

https://askubuntu.com/questions/1250517/how-can-i-turn-tpm-off-or-disable-it-in-ubuntu?

TheSidhe wrote:

> Intel Trusted Execution Technology provides these mechanisms by enabling
> an environment where applications can run within their own
> space—protected from all other software on the system. These
> capabilities provide the protection mechanisms, rooted in hardware, that
> are necessary to provide trust in the application's execution
> environment. In turn, these mechanisms can protect vital data and
> processes from being compromised by malicious software running on the
> platform.

They always want to "help protect against" all kinds of malicious stuff,
but what it all boils down to is that this whole Trusted Computing is
basically a rootkit. Read the criticisms, it's scary stuff.

Just like Intels Management Engine, which runs even when the computer is
shut down. People have been trying for years to disable it, but to no
avail.

There are some very interesting videos on YT about this IME, in case
you're interested.

>
> If using an AMD processor does it have relevance?

Yes, AMD boards have a TPM chip too. Not only that, they also have their
own Management Engine, but they call it the AMD Platform Security Processor.

https://en.wikipedia.org/wiki/AMD_Platform_Security_Processor