Intel PTT / fTPM (ECDSA and ECSchnorr timing): The firmware TPM's signing operation leaks nonce information through

Impact

The firmware TPM's signing operation leaks nonce information through timing, letting an attacker recover the private key after observing a few hundred signatures. Intel PTT is the TPM on a large share of server boards where nobody fitted a discrete chip - so this is the default configuration, not an edge case. Recovered attestation keys let an attacker sign forged quotes and make a compromised node present as measured-clean.

Who can reach it

Local unprivileged user who can request signatures, or a network attacker where the TPM key backs a network-facing service such as a VPN or TLS client certificate. No physical access needed, which is what separated this from earlier TPM side channels.

What to do

Intel CSME/PTT firmware update, delivered as a BIOS/ME package from the server OEM - per-node flash and reboot. Regenerate and re-enroll every key the fTPM signed with, because the firmware fix does not un-leak an already-extracted key. If attestation is load-bearing for your product, this is the argument for a discrete TPM over the chipset one.

References