Can Trusted computing/TPM defeat crack attempts?

Question

I read some things about trusted computing platforms (TPM) and its applications in the past.

AFAIK, its applications include such things as countering software reverse engineering/crack and cheating in multiplayer games. And nowadays, it seems that most systems (including most PCs) have trusted computing capabilities or TPM chips.

I want to know how widespread are TC applications at the moment and how successful they were (or can be if implemented/used properly - I mean without any human mistakes) in achieving their goals.

And, can TC be a definitive end to reverse engineering/crack (at least in some cases), and if not, why?

It seems to me that TC has great capabilities and can create strong protection against software manipulation, because I am somewhat informed in cryptography and I know it uses modern and strong cryptographic algorithms/protocols ... that breaking them is almost infeasible if implemented properly (free of human mistakes). But, on the other hand, I don't know why its use is not widespread yet (apparently) and almost all software are cracked everyday (Although I have some guesses myself, like extra complexity and cost required to implement such software, also the cryptography knowledge/expertise required that almost no ordinary programmer has).

So, I decided to ask this question from you here.

PS: Maybe I should have posted this question in crypto or security StackExchange sites. IDK for sure, but probably will try them if I don't get enough info here.

Answer 1

I am not sure there is a definitive answer to this.

For example, anyone with physical access to the system can do a whole manner of things that TPM may not be able to prevent.

For example, the TPM itself could be reverse engineered: http://gcn.com/articles/2010/02/02/black-hat-chip-crack-020210.aspx?m=1

Then you have timing attacks and other side channels.

And as you say yourself, cost and complexity: this is well summed up by Andrew 'Bunnie' Huang in 'Hacking the Xbox' (pg. 203, http://www.nostarch.com/xboxfree)

In the consumer electronics industry, one can either ship a perfect product, or one can make money. Products that don't make money are quickly cancelled. Thus, it is very rare to find a consumer product that is technically perfect in all respects. As a result, the only practical way to guarantee the security of consumer electronics system as complex as Palladium is to throw it into the wild, and let the hackers have their way with it for many years until all of the big security holes have been discovered and plugged.

On the other hand, the TCPA's TPM is a device created to solve a certain set of problems that is smaller in scope than Palladium's. Thus, the TPM is not as exciting from a market perspective, but it may be more practical and serviceable for its intended purpose. Both the TPM and Palladium are weak to hardware attacks, but the TPM doesn't attempt to extend security requirements as far into third-party system design territory. The TPM is primarily a secured key management module that can detect most modifications and intrusions to the host system. The software layers built on top of this substrate do the rest of the heavy lifting, caveat emptor.