7.3.0 TPM-based licensing and flash booting questions

 

1 – If I go to tools/wizards/onboarding can I switch from flash-based authentication to TPM?

GUI Main/boot/flash shows TPM licensing is available, followed by a GUID

 

2 – Will I be able to continue booting from my existing Flash drive after I switch from flash-based authentication to TPM?

 

3 – When I want to update my Flash drive to a new drive, do I run the Unraid installer on the new flash drive then copy the contents of my old flash onto my new flash drive? 

Does anything else need to be done? 

I plan on swapping out my Sandisk Cruzer Blade 32GB for a new Swissbit U500-K SLC 8GB.

 

4 – So long as I do not change my motherboard (ASUS Pro WS W680-ACE IPMI), will updating the bios or swapping out the other hardware (CPU, GPUs, Hard Drives, etc) trigger the need for a fresh TPM authentication?

Thank you!

4 hours ago, landS said:

If I go to tools/wizards/onboarding can I switch from flash-based authentication to TPM?

You can do that on Tools - Registartion is a valid TPM device is detected.

4 hours ago, landS said:

Will I be able to continue booting from my existing Flash drive after I switch from flash-based authentication to TPM?

Yes

4 hours ago, landS said:

When I want to update my Flash drive to a new drive, do I run the Unraid installer on the new flash drive then copy the contents of my old flash onto my new flash drive? 

Yes, same as before.

4 hours ago, landS said:

So long as I do not change my motherboard (ASUS Pro WS W680-ACE IPMI), will updating the bios or swapping out the other hardware (CPU, GPUs, Hard Drives, etc) trigger the need for a fresh TPM authentication?

If it's an fTPM, changing the CPU will require a new key, if it's a dedicated TPM module, only changing the board will, BIOS updates are typically not a problem.

4 hours ago, landS said:

4 – So long as I do not change my motherboard (ASUS Pro WS W680-ACE IPMI), will updating the bios or swapping out the other hardware (CPU, GPUs, Hard Drives, etc) trigger the need for a fresh TPM authentication?

Just a heads-up:

BIOS updates mentioning Secure Boot key update in their description (KEK/DB/PK) have been known to reset fTPM on some boards, which would trigger a license state mismatch.

Worth keeping in mind if you go with fTPM.

Thanks @JorgeB and @Lolight

Looking at the ASUS Pro WS W680-ACE IPMI manual, I see that a SPI TPM header exists to add a dedicated module.

Looking at the ASUS Pro WS W680-ACE IPMI BIOS manual, I see that the PCH-FW allows FIRMWARE TPM to be configured or reset.   

 

It appears that my motherboard has the ability to add a dedicated TPM module, and that I do not want to use fTPM.

 

Now I have to decide if adding a dedicated TPM module is worth it over flash-based authentication.