Does anyone know if Lumia phones have a TPM Chip? Is this device encryption based on bitlocker? And if so, how does it store the keys?

No, I think this changed with Windows Phone 8. I've read a few accounts that say that Windows Phone 8 devices are required to have TPM chip.

Windows Phone 8 has | Network World

Mystere said:

Does anyone know if Lumia phones have a TPM Chip? Is this device encryption based on bitlocker? And if so, how does it store the keys?

I am also interested in hearing more details from Microsoft, so I'm not sure whether I'll be able to provide you with any more info than you already know, however a couple of months ago I posted a link to a Channel 9 video from the Ignite 2015 conference, where one of their architects said that it's going to be possible for users to enable Bitlocker device encryption on Windows 10 Mobile. I do not know what encryption Microsoft are using in the above tutorial, so can only go off what Brink says, but you can find the Channel 9 video in the below post:

https://www.tenforums.com/windows-10-...e-devices.html

The same video also touches on TPM at around 10:00 in, where he mentions "... every Windows Phone has a TPM, every mobile device, even a Stream 7 like this from HP, has a TPM". I'm not sure about Windows 10 Mobile, but at this link it briefly mentions how TPM is implemented on Nokia Lumia Windows Phone 8 phones. Again it's aimed towards IT professionals, as consumers weren't able to enable Bitlocker on their Windows 8 phones.

How is TPM implemented in Nokia Lumia Windows Phone 8?

TPM is implemented as a software application running inside the ARM TrustZone-based secure execution environment in the Qualcomm Krait processor. It follows the TCG TPM 2.0 specification.

In addition to ARM TrustZone, the secure execution environment consists of a small amount of secure RAM and OTP (one time programmable) memory called eFuses, which contain the device unique keys and are accessible only from the TrustZone.

What is the exact procedure for the encryption and decryption and how are the device encryption keys protected on Nokia Lumia Windows Phone 8 phones?

Device mass memory encryption and decryption happens using hardware crypto accelerators:

• The encryption keys are encrypted by the software TPM with the device unique keys and stored into the RPMB (Replay Protected Memory Block) area of the eMMC memory.

• The keys are decrypted in boot by the software TPM and placed into HW crypto accelerators, which are not accessible for any other purpose than the mass memory encryption.

I have a Lumia 640 XL, with now Windows 10 Mobile / Phone installed via Insider.

I see the option to enable encryption and followed the steps above.

However, *nothing appears to happen*.

The checked items is On for encryption, but when I look at Settings - System - Storage, it does NOT say that the system is encrypted.

Also, there is no progress dialog regarding the encryption process. The On/Off toggle for encryption can be changed at will.

Does encryption even work at all on Windows 10 Mobile / Phone?

Note: I also connected the phone to an ActiveSync Office365 policy that "requires" encryption. The only thing that happens is that the toggle is now set to On, but again, no progress dialog, no indication in the Storage settings that encryption is enabled or anything.

Does encryption even work for the SDCARD?

At this point, I cannot use this device if it is not possible to verify encryption works.

Brink said:

Hello xinlifoss, and welcome to Ten Forums. :)

When you turn on device encryption, are you able to add a PIN link in step 4?

Microsoft has just released a new Windows 10 Mobile Insider Preview Build 10586.36 that you might try.

Announcing Windows 10 Mobile Insider Preview Build 10586.36 - Windows 10 Forums

thanks for the tip. yes, the phone did ask if I wanted to set a pin. I tried my tests with the pin set and without a pin set. no difference.

it took a while, but I finally got this new update installed.

alas, same pathology:

• with a local Device Encryption toggled On, no dialog, no change in Storage status
• with an activesync policy from Google Sync (Google for Work), the Requires Encryption policy is ignored by the device, so the toggle remains Off, yet the device seems to be reporting back to the server that encryption is activated because the data is syncing with the servers
• with a native Office Enterprise that has a Requires Encryption policy, the settings toggle is moved to On and greyed out so the user cannot disable, the data is syncing immediately, yet the Storage settings do not indicate that the device is encrypted.

last thing. with windows 8.1r2, the Office Enterprise did seem to set the encryption correctly.

still puzzled.