3 ms·
My (too simple) TLDR from other thread: TPM measures stuff, then we put the key in TPM and seal it to PCRs 0-13 measurements (whole boot environment). At boot,
by auslander 8y ago
My (too simple) TLDR from other thread:
TPM measures stuff, then we put the key in TPM and seal it to PCRs 0-13 measurements (whole boot environment). At boot, TPM will allow tcsd daemon (part of initrd) to read LUKS key once, and only if all measurements match, this is as far as I got.
End result is unlocked volume, without any passphrase prompts, neither on console nor via ssh.
https://news.ycombinator.com/item?id=19527493 https://news.ycombinator.com/item?id=19527493