4 ms·
I must say I am impressed by their level of professionalism and I did setup my own GPG decrypted (with Yubikey) and TPM decrypted LUKS scripts on Arch.
by Boulth 8y ago
I must say I am impressed by their level of professionalism and I did setup my own GPG decrypted (with Yubikey) and TPM decrypted LUKS scripts on Arch.
- techntoke 8y agoVery cool. Can you please help add any information to the Arch Wiki about your setup and methods? The information surrounding TPM 2.0 and Secure Boot is lacking, but an area that I hope will be greatly improved an automated.
- transpute 8y agoHere's a 2017 article on Fedora setup with TPM2, https://blog.dowhile0.org/2017/10/18/automatic-luks-volumes-unlocking-using-a-tpm2-chip/ https://blog.dowhile0.org/2017/10/18/automatic-luks-volumes-...
- tejado 8y ago+1, please share your setup
- Boulth 8y agoSorry for the late reply but check out https://github.com/electrickite/luks-tpm2 https://github.com/electrickite/luks-tpm2 and scencrypt in AUR.
- techntoke 8y agoThat is freaking cool. Thanks!
- Boulth 8y agoNo problem. If I may suggest something if you have TPM version 2 use sha256 everywhere. And you can expand the PCRs list to cover more stuff. I'm using PCRs 0 to 8 (or 9? Can't check now) so any hardware configuration change is apparent during boot. Another useful package is sbupdate [0] that not only signs kernel for SecureBoot but additionally makes it possible to boot the kernel directly from UEFI firmware bypassing the need for bootloader (be it grub or systemd boot). Once setup it just works! [0]: https://github.com/andreyv/sbupdate https://github.com/andreyv/sbupdate