7

I'm considering a touch bar Macbook Pro, but the majority of the time it will be in Boot Camp. I need to use Bitlocker, so if the machine doesn't have a Trusted Platform Module (TPM) I need to enter a second password every time going to Windows which is frustrating.

Historically, Macs have not included a hardware security (TPM) chip, but the Touch ID sensor requires hardware that serves a similar function. (Apple's name for what a TPM does is "secure enclave" and the TouchID sensor comes with one of those) Is that hardware exposed as a TPM to Boot Camp, or will I continue to need to enter Bitlocker passwords on these new MBPs?

Improve this question

2 Answers 2

Reset to default
4

Apple's iOS secure enclave is almost certainly the "flavor of TPM" that is built into the MacBook Pro. I would say it's a very, very long shot that it would be exposed to BootCamp or other virtualization apps, but there is of course hope when you have API for third party apps to get at the fingerprint sensor from macOS.

You are correct that this is the first time Apple has included this hardware on the Mac so maybe some time in the future you can expect the functionality you rightly desire. For now, I'd plan on yubikey or manual password entry.

Improve this answer
1
  • 1
    As the TouchID system in the new rMBP is programmable, it would be nice if Apple would provide a TPM interface for it and then ship those drivers for Bootcamp and Linux.
    – Dai
    Commented May 19, 2017 at 21:59
3

It seems very unlikely. The Touch ID sensor's secure enclave is sacrosanct as far as privacy and data protection are concerned, and the original iPhone 5s keynote mentioned that the data transfer between it and the main processor is minimal; as close to a pass/fail response as possible. This would make it quite a task to implement a secondary mode where the secure enclave acts as a TPM, in addition to Apple's reluctance to do so. It's worth noting that there's little hope for this being implemented by a third party as the firmware for the secure enclave, as for iOS, is signed.

As the owner of a 15" 2016 MacBook Pro I can confirm that no TPM shows up in macOS's System Information, but I don't use Bootcamp so can't test that.

Improve this answer
2
  • 1
    "as close to a pass/fail response as possible" is exactly what a TPM does
    – Billy ONeal
    Commented Dec 2, 2016 at 23:57
  • "This would make it quite a task to implement a secondary mode where the secure enclave acts as a TPM." - this makes no sense. A TPM (following the TPM specifications) provides pretty-much the same functionality as the new Secure Enclave in the rMBP so I don't see a reason why they couldn't release a Windows and Linux driver that exposes a TPM interface for their Secure Enclave. (By car analogy it's like putting an old-fashioned gasoline fuel-gauge in an electric car that's still wired up to the battery's charge/capacity sensor).
    – Dai
    Commented May 19, 2017 at 22:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .