3 ms·
This TPM guide describes TPM for LUKS. "PCR 0-7 Measured by BIOS" seems like HW fingerprint. https://github.com/morbitzer/linux-luks-tpm-boot https://github.co
by auslander 8y ago
This TPM guide describes TPM for LUKS. "PCR 0-7 Measured by BIOS" seems like HW fingerprint. https://github.com/morbitzer/linux-luks-tpm-boot https://github.com/morbitzer/linux-luks-tpm-boot
If this thing works, there is no need for remote ssh FDE unlocking.
- deleted 8y ago[deleted]
- mirimir 8y agoThanks. If I understand that correctly, the LUKS key is stored in the TPM. Which is protected by a password. So you boot into initramfs, and provide the password. And this could also work via dropbear. There'd still be an exposed dropbear SSH key in /boot. But it'd be the TPM that you're unlocking. And I assume that there are ways to verify the authenticity of the TPM via initramfs, before providing a password. Am I understanding that right? It does seem more complicated. Especially given that you don't have physical access to the server.
- auslander 8y ago> .. the LUKS key is stored in the TPM. Which is protected by a password. Yup. Nope. The key is protected by TPM magic :). TPM measures stuff, then we put the key in TPM and seal it to PCRs 0-13 measurements (whole boot environment). At boot, TPM will allow tcsd daemon (part of initrd) to read LUKS key once, and only if all measurements match, this is as far as I got. End result is unlocked volume, without any passphrase prompts, neither on console nor via ssh.