2 ms·

> what's the problem with letting the OS know the key? it already has access to all the files! How about when your device is locked in sleep mode. The main pro

> what's the problem with letting the OS know the key? it already has access to all the files! How about when your device is locked in sleep mode. The main processor should lose the key to a certain set of files, as does on iOS.

gruez 8y ago
that's more of an argument for encrypting filesystem instead of full disk encryption (which I agree would help in that situation), not an argument for having a custom security co-processor. you can accomplish the same thing with TPM: by using PCR sealed keys for the OS files, PCR + password sealed keys for private/personal files, and wiping the second set of keys every time you lock the computer.