3 ms·
The advantage of a TPM embedded in the platform is that it is aware of the platform's state - the hashes of the firmware, option ROMs and the bootloader/UEFI bi
by Nextgrid 3y ago
The advantage of a TPM embedded in the platform is that it is aware of the platform's state - the hashes of the firmware, option ROMs and the bootloader/UEFI binary that you're loading. Discrete TPMs are vulnerable to bus interception attacks but newer firmware TPMs are embedded in the CPU/SoC and are invulnerable to this so it's pretty secure.
A YubiKey/external TPM in comparison has no way to know whether it's being fed true PCR readings from the host or fakes from a malicious attacker, so at this point it will be no different (in the context of full-disk-encryption) from just having a dumb USB storage device with your LUKS keyfile on it.