3 ms·
I have FDE with keys in the TPM. It's pretty smooth bit required a one time additional step in Fedora. It's also probably not very secure, but my threat model i
by cedilla 15d ago
I have FDE with keys in the TPM. It's pretty smooth bit required a one time additional step in Fedora. It's also probably not very secure, but my threat model is simple theft.
- avhception 15d agoWhat's the benefit of using the TPM compared to a simple passphrase at boot, in that scenario?
- theblazehen 15d agoA person wouldn't be able to pull the disk to get at the information
- avhception 11d agoAssuming that the person pulling the disk doesn't have the passphrase, what's the difference?
- theblazehen 9d agoAssuming things are configured correctly, the TPM would only provide the key to unlock the drive if the correct OS has been booted. Attempting to boot from a live usb to have a look at the data wouldn't work, since the TPM wouldn't present the key required. You can see https://wiki.archlinux.org/title/Trusted_Platform_Module#PCR_policies https://wiki.archlinux.org/title/Trusted_Platform_Module#PCR... for an example of doing so
- cedilla 10d agoSorry for the late answer: the benefit is that I don't have to enter my passphrase at boot.