So am I correct in understanding that this could be used to make a tool to unlock any encrypted disk that relies on the tpm whilst something like luks or indeed any solution that doesn’t rely on the bios being secure would be fine.
Note I’m talking about a stolen laptop not an evil maid situation.
I’m just experiencing a bit of schadenfreude because I’ve had several discussions in which it was claimed that this configuration relying only on the TPM was entirely secure and I was foolish for relying on a passphrase.
No. Your actually encryption key is a random number not a password. Your password is used to decrypt your actually key which is loaded into memory and used to read encrypted data.
In no configuration is it just stored in clear text.
I have set up many of these systems and every one stores a string (a password) in the TPM which is then fed into the LUKS system as a regular password.
So am I correct in understanding that this could be used to make a tool to unlock any encrypted disk that relies on the tpm whilst something like luks or indeed any solution that doesn’t rely on the bios being secure would be fine.
Note I’m talking about a stolen laptop not an evil maid situation.
Not necessarily. Luks can be used with TPM. Although I’ve never seen it in practice.
Most Linux distros offer a standard Luks with passphrase setup with just a single checkmark, but enabling TPM takes more work.
I’m just experiencing a bit of schadenfreude because I’ve had several discussions in which it was claimed that this configuration relying only on the TPM was entirely secure and I was foolish for relying on a passphrase.
Sounds like luks is borked as well if youre using only tpm state to unlock, which you shouldnt
All of the LUKS integrations literally just store a password and then type that into the thing upon boot
NOTHING works this way it would be horribly insecure and it absolutely doesn’t work that way.
No it’s about how it works. There’s lots of vulns because of it.
No. Your actually encryption key is a random number not a password. Your password is used to decrypt your actually key which is loaded into memory and used to read encrypted data.
In no configuration is it just stored in clear text.
I have set up many of these systems and every one stores a string (a password) in the TPM which is then fed into the LUKS system as a regular password.