In theory anything can be bypassed including TXT, TXT on it's own does not provide any substantial amount of protection against tampering at least not over traditional TPM setups.
What it does is centralizes all of the measurements in one place and adds DRM.
It's not bad in any way but it's also not required to run a secure boot encryption setup.
My 9 year old HP Compaq 6910p Centrino with TPM can offer almost the same level of protection as any modern Intel vPro laptop.
Case for Bitlocker (one of the few FDE's that actually has good integrity checks)
BIOS / UEFI modification (Update, revision, settings
change etc.) - both will trigger recovery mode
-Boot loader modification - both will trigger recovery mode
-Boot order change - both will trigger recovery mode
-Boot attempt number does match between TPM & HDD (e.g.
when the HDD was removed and attempted to be booted in another device, or when the machine was booted not from the HDD) - both will trigger recovery mode
-Data partition changed - both will trigger recovery mode
The only difference is that if my device is in either S4 and S5 mode TXT can still continue to make measurements, and the measurements that TXT allows you to do are very generic unlike standard TPM/Secureboot which only checks for specific parameters.
You also need to understand that FDE is not designed to protect your information in such cases where you lose control of the physical security of the device and do not treat it as untrustworthy afterwards, it's more or less excellent at protecting your data while it's in rest if the device is lost or stolen but that's it.
And while yes secure boot can be bypassed and TPM's could also potentially be broken (which invalidates TXT as well since it uses the TPM as the cryptographic storage device for the signatures) an adversary that can bypass one could most likely bypass the others (you also need to remember that with TXT the measurement plan is stored in the UEFI flash/ram/nvram not in the TPM) and with any system your overall level of confidence should be as high as the weakest component.
What it does is centralizes all of the measurements in one place and adds DRM.
It's not bad in any way but it's also not required to run a secure boot encryption setup.
My 9 year old HP Compaq 6910p Centrino with TPM can offer almost the same level of protection as any modern Intel vPro laptop.
Case for Bitlocker (one of the few FDE's that actually has good integrity checks)
BIOS / UEFI modification (Update, revision, settings change etc.) - both will trigger recovery mode
-Boot loader modification - both will trigger recovery mode
-Boot order change - both will trigger recovery mode
-Boot attempt number does match between TPM & HDD (e.g. when the HDD was removed and attempted to be booted in another device, or when the machine was booted not from the HDD) - both will trigger recovery mode
-Data partition changed - both will trigger recovery mode
The only difference is that if my device is in either S4 and S5 mode TXT can still continue to make measurements, and the measurements that TXT allows you to do are very generic unlike standard TPM/Secureboot which only checks for specific parameters.
You also need to understand that FDE is not designed to protect your information in such cases where you lose control of the physical security of the device and do not treat it as untrustworthy afterwards, it's more or less excellent at protecting your data while it's in rest if the device is lost or stolen but that's it. And while yes secure boot can be bypassed and TPM's could also potentially be broken (which invalidates TXT as well since it uses the TPM as the cryptographic storage device for the signatures) an adversary that can bypass one could most likely bypass the others (you also need to remember that with TXT the measurement plan is stored in the UEFI flash/ram/nvram not in the TPM) and with any system your overall level of confidence should be as high as the weakest component.