Ask HN: Is discrete TPM worth it? with QubesOS/aem/heads/Intel-me disabled

2 pointsPrimaryAlibi1y ago1 comments

I couldn't find info if disabling intel management engine with HAP bit or through bios settings will also disable the firmware TPM or intel TXT. If disabling intel ME doesn't disable the latter two features then a discrete TPM is not necessary.

To be clear, I'm not talking about overwriting large parts of intel ME with zeros. This is only the simple way of setting the HAP bit or disabling it in BIOS settings.

QubesOS doesn't require a TPM but qubesOS is often used with AEM or Heads. It's also popular to disable intel ME. Both Heads and AEM requires a TPM. AEM also requires intel TXT.

This means if disabling intel ME also disables firmware TPM and intel TXT then it's necessary to have a discrete TPM. So that is the main question here. I couldn't find an answer, does anyone know and can link to the source for verification?

Maybe it's also not possible or unecessary to disable intel ME if your CPU doesn't have AMT. You can see of your CPU has AMT or not on intel's website. So if it says there is not AMT feature, then it maybe means it's uneccesary to get a discrete TPM?

1 comments

fsflover1y ago

I'm using TMP with a Librem Key on my Librem 14 with a disabled ME just fine.

j / k navigate · click thread line to collapse

Ask HN: Is discrete TPM worth it? with QubesOS/aem/heads/Intel-me disabled

2 pointsPrimaryAlibi1y ago1 comments

To be clear, I'm not talking about overwriting large parts of intel ME with zeros. This is only the simple way of setting the HAP bit or disabling it in BIOS settings.

QubesOS doesn't require a TPM but qubesOS is often used with AEM or Heads. It's also popular to disable intel ME. Both Heads and AEM requires a TPM. AEM also requires intel TXT.