3 ms·

The MOK thing is secure boot, not TPM related. You can have arbitrarily complex TPM authorization policies for unlocking storage keys. You can have it be that

The MOK thing is secure boot, not TPM related. You can have arbitrarily complex TPM authorization policies for unlocking storage keys. You can have it be that the loaded firmwares and OS are trusted and (or or) you have to enter in a passphrase that only the TPM can verify, and/or you can have a recovery mechanism so that if some firmware got updated you could use a smartcard or whatever to authorize moving on anyways. So, while OSes that support TPMs for storage key recovery generally have -as you say- hair-trigger policies, that's not TPM's fault but the OS's, for they could develop much more interesting policies.

nextaccountic 4y ago
How to do those things in Linux?
- vladvasiliu 4y ago
  Assuming you'll use LUKS for drive encryption, you can have several key slots that all allow unsealing the key to decrypt the drive. 1. You'll have your master password, for which it asks when you first create it. You can make this absurdly long and consider it'll be used as a last resort (say you've lost everything else and your computer is broken - you only have the drive left). 2. You can then add Windows-style auto-unlock with the TPM. It works with systemd. You can of course choose whichever registers you like, the correct TPM device if you have several. systemd-cryptenroll /dev/sda1 --tpm2-device=auto --tpm2-pcrs=0+1+7 3. If you're somewhat paranoid, you can have it ask for a PIN. Just add --tpm2-with-pin=true to the above. 4. What if this is an external drive and / or often change your UEFI settings yet still need a quick unlock? Luckily, you have a FIDO2 device, so systemd's got you covered: --unlock-fido2-device=auto instead of the tpm2 5. You can probably combine TPM + FIDO2, I've never tried it. Check the Arch wiki for more: https://wiki.archlinux.org/title/Trusted_Platform_Module#Using_TPM_2.0 https://wiki.archlinux.org/title/Trusted_Platform_Module#Usi... --- edit: it should be noted that even on Windows, there's a recovery key which allows you to unlock bitlocker if the TPM was cleared. It's not clear what the poster above said that the data would be nuked (unless, of course, you only count on the TPM and don't save that key somewhere).
- cryptonector 4y ago
  Code needs to be written :(

nextaccountic 4y ago

How to do those things in Linux?

vladvasiliu 4y ago
Assuming you'll use LUKS for drive encryption, you can have several key slots that all allow unsealing the key to decrypt the drive. 1. You'll have your master password, for which it asks when you first create it. You can make this absurdly long and consider it'll be used as a last resort (say you've lost everything else and your computer is broken - you only have the drive left). 2. You can then add Windows-style auto-unlock with the TPM. It works with systemd. You can of course choose whichever registers you like, the correct TPM device if you have several. systemd-cryptenroll /dev/sda1 --tpm2-device=auto --tpm2-pcrs=0+1+7 3. If you're somewhat paranoid, you can have it ask for a PIN. Just add --tpm2-with-pin=true to the above. 4. What if this is an external drive and / or often change your UEFI settings yet still need a quick unlock? Luckily, you have a FIDO2 device, so systemd's got you covered: --unlock-fido2-device=auto instead of the tpm2 5. You can probably combine TPM + FIDO2, I've never tried it. Check the Arch wiki for more: https://wiki.archlinux.org/title/Trusted_Platform_Module#Using_TPM_2.0 https://wiki.archlinux.org/title/Trusted_Platform_Module#Usi... --- edit: it should be noted that even on Windows, there's a recovery key which allows you to unlock bitlocker if the TPM was cleared. It's not clear what the poster above said that the data would be nuked (unless, of course, you only count on the TPM and don't save that key somewhere).
cryptonector 4y ago
Code needs to be written :(