Earlier quoted context omitted.
> This post will look at extracting the clear-text key from a TPM chip by sniffing the LPC bus It is a very interesting read but the title is a bit clickbaity. Luckily it's not with bad intentions, the first few lines (above) already tell you what it is. > I'm not sure what the distinction you're making is Imagine I tell you I can extract any information I want from the human brain. You'd be intrigued, how do I inter…
Honestly it feels like splitting hairs, unless I'm misunderstanding something. What is there to gain "cracking" the TPM itself, if you can get the keys fine by sniffing? Apple's Secure Enclaves aren't vulnerable to sniffing, as the AES keys used for encryption live only in silicon, with access to use them granted to the Enclave. The keys never exist in a software-readable form, even to the coveted Enclave firmware. D…
Sniffing requires the TPM be unlocked first. If you can't get it unlocked (poor wording, but it will do), no amount if sniffing is going to get you anywhere. They sort of acknowledge that here:
> Don’t want to be vulnerable to this? Enable additional pre-boot authentication.
If they really could just extract keys from a TPM without if being unlocked there would be little point in having a TPM at all. "Little point in having a TPM at all" would be big news, and the reason many of use read the article is because the headline implied it was describing a way to do just that.
In reality the TPM remains perfectly capable of keeping it's secrets secret until someone with the right credentials comes along, and proves they have them to the TPM itself. But in the scenario described the only "credentials" required to make Bitlocker unlock the TPM was was someone pressing the on switch.
So it doesn't sound like someone extracted the keys from the TPM to me. Once the software has unlocked it and asked it to send the keys, they will exist in multiple locations. The LPC bus is one, but they will also end up in RAM, or for that matter intercept the keying material when it is sent via the SATA bus to the drives.