{"id":31864,"date":"2019-11-12T19:43:48","date_gmt":"2019-11-12T19:43:48","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/dont-trust-the-trusted-platform-module-it-may-leak-your-vpn-servers-private-key-depending-on-your-configuration\/"},"modified":"2019-11-12T19:43:48","modified_gmt":"2019-11-12T19:43:48","slug":"dont-trust-the-trusted-platform-module-it-may-leak-your-vpn-servers-private-key-depending-on-your-configuration","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/dont-trust-the-trusted-platform-module-it-may-leak-your-vpn-servers-private-key-depending-on-your-configuration\/","title":{"rendered":"Don&#8217;t trust the Trusted Platform Module \u2013 it may leak your VPN server&#8217;s private key (depending on your configuration)"},"content":{"rendered":"<p>Trusted Platform Modules, specialized processors or firmware that protect the cryptographic keys used to secure operating systems, are not entirely trustworthy.<\/p>\n<p>Boffins from the Worcester Polytechnic Institute and University of California, San Diego, in the US, and the University of Lu\u0308beck in Germany, have found that TPMs leak timing information that allows the recovery of the private keys used for cryptographic signatures.<\/p>\n<p>In <a target=\"_blank\" rel=\"nofollow noopener noreferrer\" href=\"http:\/\/tpm.fail\/tpmfail.pdf\">a paper<\/a> [PDF] published on Tuesday, &#8220;TPM-FAIL: TPM meets Timing and Lattice Attacks,&#8221; researchers Daniel Moghimi, Berk Sunar, Thomas Eisenbarth, and Nadia Heninger describes how they successfully conducted black-box timing analysis of TPM 2.0 devices to recover 256-bit private keys for ECDSA (Elliptic Curve Digital Signature Algorithm) and <a target=\"_blank\" rel=\"nofollow noopener noreferrer\" href=\"https:\/\/blog.iuliancostan.com\/post\/2019-06-25-ec-schnorr\/\">ECSchnorr<\/a> signatures that are supposed to remain unobserved within the TPM.<\/p>\n<p>Timing measurements represent a side channel attack that can be used to infer the inner workings of cryptographic systems.<\/p>\n<p>&#8220;Our analysis reveals that elliptic curve signature operations on TPMs from various manufacturers are vulnerable to timing leakage that leads to recovery of the private signing key,&#8221; the paper states. &#8220;We show that this leakage is significant enough to be exploited remotely by a network adversary.&#8221;<\/p>\n<h3 class=\"crosshead\"><span>Key recovery<\/span><\/h3>\n<p>The researchers found that a local attacker can recover the ECDSA key from Intel fTPM in 4-20 minutes, depending upon the available level of access. The technique can also be conducted remotely to obtain the authentication key from a VPN server in five hours or so.<\/p>\n<p>In an email to <em>The Register<\/em>, Moghimi said the remote attack scenario assumes there&#8217;s a VPN configured to use the TPM for authentication and is publicly available on a network.<\/p>\n<p>&#8220;A client who is supposed to use the VPN as a service acts as an adversary and steals the VPN server&#8217;s private key,&#8221; said Moghimi. &#8220;As a result, she can impersonate the VPN&#8217;s server and compromise the secure communication of other users with the VPN server.&#8221;<\/p>\n<p>Moghimi said the attacker would need to conduct multiple authentication handshakes in order to measure the time each takes and then use that time measurement as a side-channel to discern information about the VPN server&#8217;s secrets inside the TPM. Such handshakes, he said, look like normal network traffic and wouldn&#8217;t be obviously malicious.<\/p>\n<p>&#8220;The remote attack takes much longer due to the network&#8217;s noise on the timing channel,&#8221; said Moghimi. &#8220;The faster a network is, the remote attack can be performed better since there will be less timing noise. We tested on a simple 1GB local network which is common in many organizations and companies. I can imagine the remote attack would be faster\/easier on a 10GB network or a fiber network.&#8221;<\/p>\n<div class=\"promo_article\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/regmedia.co.uk\/2017\/03\/14\/zombies_photo_via_shutterstock.jpg?x=174&amp;y=115&amp;crop=1\" width=\"174\" height=\"115\" alt=\"Zombies photo via Shutterstock\"><\/p>\n<h2 title=\"Boffins say even latest chips can be twisted into leaking data between processor cores\">True to its name, Intel CPU flaw ZombieLoad comes shuffling back with new variant<\/h2>\n<p><a href=\"https:\/\/www.theregister.co.uk\/2019\/11\/12\/zombieload_cpu_attack\/\"><span>READ MORE<\/span><\/a><\/div>\n<p>The researchers identified flaws in Intel&#8217;s fTPM, a firmware-based TPM on computers running Intel&#8217;s management engine on PCs and laptops from vendors like Asus, Lenovo, Dell, and HP, and in computers with dedicated TPM hardware made by STMicroelectronics (<a target=\"_blank\" rel=\"nofollow noopener noreferrer\" href=\"https:\/\/www.st.com\/content\/st_com\/en\/products\/secure-mcus\/authentication\/authentication\/st33tpm12spi.html#resource\">ST33TPHF2ESPI<\/a>). These vulnerabilities exist in devices certified FIPS 140-2 Level 2 and Common Criteria (CC) EAL 4+, certifications bestowed on hardware believed to be resistant to side-channel attacks.<\/p>\n<p>The boffins also tested TPMs by Infineon and Nuvoton. The Infineno hardware (SLB 9670) exhibited non-constant time behavior but did not appear to have an exploitable vulnerability. The Nuvoton unit (rls NPCT) showed constant-time behavior for ECDSA, meaning it&#8217;s not vulnerable.<\/p>\n<p>The security flaws have been designated CVE-2019-11090 for Intel fTPM vulnerabilities and CVE-2019-16863 for STMicroelectronics TPM chip. The researchers responsibly disclosed their findings to the two companies, and the publication of their work \u2013 to be presented at the Real World Crypto 2020 conference in January \u2013 coincides with patches from Intel and STMicroelectronics.<\/p>\n<p>Intel addresses the flaws in the <a target=\"_blank\" rel=\"nofollow noopener noreferrer\" href=\"https:\/\/www.intel.com\/content\/www\/us\/en\/security-center\/advisory\/intel-sa-00241.html\">INTEL-SA-00241<\/a> patch, which covers multiple CVEs. STMicroelectronics did not immediately respond to a request for comment, but the researchers say the biz has issued a new chip that fixes the flaws.<\/p>\n<p>Intel disclosed its patch in a <a target=\"_blank\" rel=\"nofollow noopener noreferrer\" href=\"https:\/\/blogs.intel.com\/technology\/2019\/11\/ipas-november-2019-intel-platform-update-ipu\/\">new security blog<\/a>, noting that it found 22 of 24 flaws related to its management engine.<\/p>\n<p>The now-obligatory vulnerability website, <a target=\"_blank\" rel=\"nofollow noopener noreferrer\" href=\"http:\/\/tpm.fail\/\">TPM.fail<\/a>, provides further details. \u00ae<\/p>\n<p class=\"wptl btm\"><span>Sponsored:<\/span> <a href=\"https:\/\/go.theregister.co.uk\/tl\/1858\/-7802\/technical-overview-exasol-peek-under-the-hood?td=wptl1858\">Technical Overview: Exasol Peek Under the Hood<\/a><\/p>\n<p>READ MORE <a href=\"https:\/\/go.theregister.co.uk\/feed\/www.theregister.co.uk\/2019\/11\/12\/don\/\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>You know what they say: Timing is&#8230; everything Trusted Platform Modules, specialized processors or firmware that protect the cryptographic keys used to secure operating systems, are not entirely trustworthy.\u2026 READ MORE HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":31865,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[63],"tags":[],"class_list":["post-31864","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-the-register"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Don&#039;t trust the Trusted Platform Module \u2013 it may leak your VPN server&#039;s private key (depending on your configuration) 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/dont-trust-the-trusted-platform-module-it-may-leak-your-vpn-servers-private-key-depending-on-your-configuration\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Don&#039;t trust the Trusted Platform Module \u2013 it may leak your VPN server&#039;s private key (depending on your configuration) 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/dont-trust-the-trusted-platform-module-it-may-leak-your-vpn-servers-private-key-depending-on-your-configuration\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2019-11-12T19:43:48+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2019\/11\/dont-trust-the-trusted-platform-module-it-may-leak-your-vpn-servers-private-key-depending-on-your-configuration.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"174\" \/>\n\t<meta property=\"og:image:height\" content=\"115\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/dont-trust-the-trusted-platform-module-it-may-leak-your-vpn-servers-private-key-depending-on-your-configuration\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/dont-trust-the-trusted-platform-module-it-may-leak-your-vpn-servers-private-key-depending-on-your-configuration\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Don&#8217;t trust the Trusted Platform Module \u2013 it may leak your VPN server&#8217;s private key (depending on your configuration)\",\"datePublished\":\"2019-11-12T19:43:48+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/dont-trust-the-trusted-platform-module-it-may-leak-your-vpn-servers-private-key-depending-on-your-configuration\\\/\"},\"wordCount\":715,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/dont-trust-the-trusted-platform-module-it-may-leak-your-vpn-servers-private-key-depending-on-your-configuration\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/11\\\/dont-trust-the-trusted-platform-module-it-may-leak-your-vpn-servers-private-key-depending-on-your-configuration.jpg\",\"articleSection\":[\"The Register\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/dont-trust-the-trusted-platform-module-it-may-leak-your-vpn-servers-private-key-depending-on-your-configuration\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/dont-trust-the-trusted-platform-module-it-may-leak-your-vpn-servers-private-key-depending-on-your-configuration\\\/\",\"name\":\"Don't trust the Trusted Platform Module \u2013 it may leak your VPN server's private key (depending on your configuration) 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/dont-trust-the-trusted-platform-module-it-may-leak-your-vpn-servers-private-key-depending-on-your-configuration\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/dont-trust-the-trusted-platform-module-it-may-leak-your-vpn-servers-private-key-depending-on-your-configuration\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/11\\\/dont-trust-the-trusted-platform-module-it-may-leak-your-vpn-servers-private-key-depending-on-your-configuration.jpg\",\"datePublished\":\"2019-11-12T19:43:48+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/dont-trust-the-trusted-platform-module-it-may-leak-your-vpn-servers-private-key-depending-on-your-configuration\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/dont-trust-the-trusted-platform-module-it-may-leak-your-vpn-servers-private-key-depending-on-your-configuration\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/dont-trust-the-trusted-platform-module-it-may-leak-your-vpn-servers-private-key-depending-on-your-configuration\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/11\\\/dont-trust-the-trusted-platform-module-it-may-leak-your-vpn-servers-private-key-depending-on-your-configuration.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/11\\\/dont-trust-the-trusted-platform-module-it-may-leak-your-vpn-servers-private-key-depending-on-your-configuration.jpg\",\"width\":174,\"height\":115},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/dont-trust-the-trusted-platform-module-it-may-leak-your-vpn-servers-private-key-depending-on-your-configuration\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Don&#8217;t trust the Trusted Platform Module \u2013 it may leak your VPN server&#8217;s private key (depending on your configuration)\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Don't trust the Trusted Platform Module \u2013 it may leak your VPN server's private key (depending on your configuration) 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/dont-trust-the-trusted-platform-module-it-may-leak-your-vpn-servers-private-key-depending-on-your-configuration\/","og_locale":"en_US","og_type":"article","og_title":"Don't trust the Trusted Platform Module \u2013 it may leak your VPN server's private key (depending on your configuration) 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/dont-trust-the-trusted-platform-module-it-may-leak-your-vpn-servers-private-key-depending-on-your-configuration\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2019-11-12T19:43:48+00:00","og_image":[{"width":174,"height":115,"url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2019\/11\/dont-trust-the-trusted-platform-module-it-may-leak-your-vpn-servers-private-key-depending-on-your-configuration.jpg","type":"image\/jpeg"}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/dont-trust-the-trusted-platform-module-it-may-leak-your-vpn-servers-private-key-depending-on-your-configuration\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/dont-trust-the-trusted-platform-module-it-may-leak-your-vpn-servers-private-key-depending-on-your-configuration\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Don&#8217;t trust the Trusted Platform Module \u2013 it may leak your VPN server&#8217;s private key (depending on your configuration)","datePublished":"2019-11-12T19:43:48+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/dont-trust-the-trusted-platform-module-it-may-leak-your-vpn-servers-private-key-depending-on-your-configuration\/"},"wordCount":715,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/dont-trust-the-trusted-platform-module-it-may-leak-your-vpn-servers-private-key-depending-on-your-configuration\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2019\/11\/dont-trust-the-trusted-platform-module-it-may-leak-your-vpn-servers-private-key-depending-on-your-configuration.jpg","articleSection":["The Register"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/dont-trust-the-trusted-platform-module-it-may-leak-your-vpn-servers-private-key-depending-on-your-configuration\/","url":"https:\/\/www.threatshub.org\/blog\/dont-trust-the-trusted-platform-module-it-may-leak-your-vpn-servers-private-key-depending-on-your-configuration\/","name":"Don't trust the Trusted Platform Module \u2013 it may leak your VPN server's private key (depending on your configuration) 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/dont-trust-the-trusted-platform-module-it-may-leak-your-vpn-servers-private-key-depending-on-your-configuration\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/dont-trust-the-trusted-platform-module-it-may-leak-your-vpn-servers-private-key-depending-on-your-configuration\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2019\/11\/dont-trust-the-trusted-platform-module-it-may-leak-your-vpn-servers-private-key-depending-on-your-configuration.jpg","datePublished":"2019-11-12T19:43:48+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/dont-trust-the-trusted-platform-module-it-may-leak-your-vpn-servers-private-key-depending-on-your-configuration\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/dont-trust-the-trusted-platform-module-it-may-leak-your-vpn-servers-private-key-depending-on-your-configuration\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/dont-trust-the-trusted-platform-module-it-may-leak-your-vpn-servers-private-key-depending-on-your-configuration\/#primaryimage","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2019\/11\/dont-trust-the-trusted-platform-module-it-may-leak-your-vpn-servers-private-key-depending-on-your-configuration.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2019\/11\/dont-trust-the-trusted-platform-module-it-may-leak-your-vpn-servers-private-key-depending-on-your-configuration.jpg","width":174,"height":115},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/dont-trust-the-trusted-platform-module-it-may-leak-your-vpn-servers-private-key-depending-on-your-configuration\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Don&#8217;t trust the Trusted Platform Module \u2013 it may leak your VPN server&#8217;s private key (depending on your configuration)"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/31864","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=31864"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/31864\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media\/31865"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=31864"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=31864"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=31864"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}