Ignorance is bliss, so why do I drink so much?
I've heard of "TPM", but never really looked into it. According to the Wikipedia page it's primarily for ensuring that software/hardware hasn't been tampered with. I found this long list of (all?) HP products that are effected by this:
So there is a *lot* of stuff out there with these chips.
However, I have to wonder what there is of importance that actually uses this stuff. Under Linux there's a "TrouSerS" library that seems to be the way that most people access TPM, including libengine-tpm-openssl, by which you can generate keys via OpenSSL using TPM. However, it doesn't seem to be generally used. I also found someone who managed to get OpenSSH to use TPM, but again, this does not seem to be common.
My understanding was that RSA keys for certificates, ssh keys and things I generally care about are generated using the normal processor rather than special hardware.
A quick look makes it seem that none of the stuff I use (and care about) will be effected, but that's based on a whole 5 minutes of half-arsed research. Can anyone shed some light on the applicability of this vulnerability?