I've used a Tang server to provide encryption keys. Since I don't take my laptop out of my home much, I like the idea that only a passphrase can unlock my machine outside of my home network. It works well for home servers also, and I don't need a bunch of secure boot and storage pcr configs that get mucked up during bios updates.
My model of defense is.if someone is in my house taking all my stuff, I'm probably owned though a smash and grab yields nothing. Plan accordingly for your needs I guess.
To counter some of the (valid) privacy concerns around TPM unlocked FDE, one big benefit is when it comes to decommissioning physically secure machines. If you aren’t concerned about the evil maid scenario and have reason to avoid network based unlocking, TPM unlocked FDE keeps your machines remotely rebootable while still allowing you pull a disk and send it for secure shredding at server EOL. That is to say, if your scenario is “encrypted at rest on a physically secure and trusted server” (more concerned with the storage medium alone), it’s a good fit. It means you’re not reliant on the OEMs opaque secure erase functionality.
I always struggle to understand the point of using disk encryption with TPM, as opposed to the disk encryption with LUKS + passphrase which you remember
With TPM you depend on it so much. What if it breaks? Should I backup the recovery key beforehand? My life has enough keys already
Moving the disk to a new laptop also becomes pain
> What if it breaks? Should I backup the recovery key beforehand?
TPM unlocking uses a keyslot in a LUKS container, just like your passphrase does. There are 10 keyslots, so it's not mutually exclusive operation. If TPM doesn't unlock LUKS (as would happen when you put the drive in another device), the bootloader will prompt for a passphrase just like it did before, once entered it will decrypt from another keyslot.
Extraordinary how Linux continues to be 20 years behind Microsoft and Apple when it comes to FDE. This is a hilariously stupid level of complexity for something that should have a universal solution across distros by now.
This is literally a one click process in Windows (plus a couple shell commands to enable TPM+PIN).
I'm not disparaging the author in any way — he's merely documenting the stupidity.
On both my Fedora laptop and on my MacBook, I have to enter a password at boot to unlock the hard drive, and both had similar complexity to set it up (in Fedora I clicked a button and entered a password during the install, on Mac I clicked a button and wrote down a backup key after the install).
I think this is specifically for the TPM2 integration, which isn’t required for FDE. But I assume it makes it smoother. System updates that requires multiple reboots for example are more annoying on Fedora, since every reboot requires re-entering the password, while on Mac I just login after the final reboot.
FDE without TPM requires the passphrase to have as many bits of security as you want the encryption to have. With a TPM you can have something as short as a PIN, since the TPM can limit the rate at which password attempts are made. I assume most users are satisfied with the weak security implied by a short passphrase, but a dedicated attacker could likely crack it.
I mean, Linux has perfectly good FDE - just the user has to type in their password at boot, no TPM involved.
And it's been possible to get Windows-style self-unlocking FDE for 10+ years, such as by using Ubuntu Core - it just costs a bit, and most users aren't willing to pay $$$ to type one less password.
The design of the TPM makes much more sense for a closed-source operating system, where making it impossible to run a non-microsoft-signed OS protects you against rootkits. Open source OSes don't get that benefit, and the remaining benefits are very minor (and come with big downsides) so I can see why open source developers weren't in a hurry.
> The design of the TPM makes much more sense for a closed-source operating system
I don't think that's the case. The great thing about TPMs is that they measure what's on your system. As long as you modify things properly, your changes get measured and stored in the TPM.
Secure Boot is the more closed-sourced way. By default it relies on Microsoft keys unless you enroll your own and sign your stuff.
What problem is this solving though? The post says they're doing this to avoid typing passphrases. Why would you want the private key hidden in the tpm chip of that device? How will you decrypt if the laptop goes bust or if you move the drive elsewhere?
The TPM generates a strong, non-exportable key in hardware that is far less susceptible to brute-force attacks.
As opposed to accidentally creating your own key of "4", for instance.
A PIN can be used to protect the TPM from unlocking. Even if you set a PIN of "1234" — it would still be far more secure if the disk and laptop were ever to become separated, because the TPM will have generated a strong key anyway.
The TPM is basically a smart card soldered to the motherboard.
> How will you decrypt if the laptop goes bust or if you move the drive elsewhere
Windows and Apple both generate a recovery key as part of the enrollment process which you can store offline.
When you format LUKS you can add multiple decryption keys in case the TPM is hosed for some reason like the mobo failing. Can even use a Yubikey instead of a TPM. Or both. Or none. It's really up to you.
That's a minor convenience to not type passphrases and a fairly high risk of you losing the backup key. Not to mention, the entirely separate problem of storing the backup key securely. It doesn't pass the xkcd "correct horse battery staple" test for me.
Fedora uses LUKS where your backup key can just be a regular passphrase. A key derivation function is used internally to help with mitigating brute force attacks.
No, yubikey in the fido/webauthn form protects against phishing/TOTP snooping and replay over the web. TPMs for luks don't. See the other thread about evil maid.
Doesn't MS use bitlocker? Or did for a long time, and haven't serious vulns been found in it? If so, I'm not even sure it's a valid comparison. One is real encryption the other is crypto-theater.
Also, isn't the insanity due to MS' influence? They were rumored to do this with influencing the UEFI spec, making Linux less desirable because it was so difficult to dual boot or even single boot UEFI when it came out. This conveniently helped windows hold market share (I'm going back to ballmer Linux=cancer days).
It would stand to reason MS would use their influence to make TPMs insane for end users to manage in Linux but a breeze in windows for the same reason. This is presuming we both agree that MS exerts control over hw manufacturers, I think this is clearly the case.
Has nothing to do with distros. This is you encrypting your disk for the kernel to open during boot. It literally prompts you normally when it hits the step where it attempts to mount the main partition. The way Linux does it is far more flexible and secure because the keys aren't sent to some third party and no one can unlock it without your keys. You are free to use anything to sign the LUKS partition besides a TPM or some silly pin like a Yubikey or whatever the hell you want.
On Fedora I implemented TPM2 unlock with strong PCR pins selection with ease. For the ocasional PCR mismatch (on firmware upgrades mostly), I have password, recovery code and even a FIDO2 USB key as options. LUKS2 + Systemd make it so easy to implement. Folks forget that LUKS2 support many unlock slots and methods.
This works equally well on Debian 13, but I found that installing Dracut (which will be the default from Debian 14 onwards) made the whole process smoother.
Sealing to a reasonable subset of PCRs (ie, not just 7 like the article) is reasonably strong against point-in-time evil maid, no?
Like, in Evil Maid Scenario 1, where the Evil Maid only has one-time access, if you've sealed to say 0,2,4,7,9 , or 7 and 15 with a reasonable setup for what gets extended into 15, the Evil Maid's Fake PIN Entry Software would _not_ validate in the secured boot configuration and couldn't actually unseal the TPM, only coerce you into entering your PIN. Then the Evil Maid would have to physically return to your "correct" boot state with the PIN to unseal the disk, no?
(this is all modulo firmware and early boot exploits, of course, since in that case the attestation could also be forged also)
I would call out if it is a solder on TPM (or worse a removable module) MITM attacks work against the TPM. (I don't know why, but apparently new dell servers are still shipping with solder on TPMs and having the BIOS/UEFI firmware measure into that instead of just using the AMD EYPYC CPU's fTPM.) TPM isn't actually going and measuring anything on its own, it just gets PCR extend commands containing hashes sent over from the CPU that it has to trust are meaningful. If you can watch the bus (usually just SPI) it would be trivial to monitor the traffic to the TPM during a reboot and watch the hashes it is expecting to see, at least for the boot artifacts, which could be replayed into the TPM after it is disconnected, and then the TPM would happily unseal the secrets for the attacker's microcontroller, even for sealed secrets they weren't able to watch go past while monitoring. So, IMO against physical access the PCRs aren't doing a whole lot, and the whole thing is resting on a PIN. (Obviously this is a huge problem for servers, where a PIN is probably not in use.)
No, I think this is a valid threat model and a good rebuttal. The evil maid steals the original laptop, replaces it with a second laptop with a look-alike PIN entry screen without an attestation. You enter your PIN, it is transmitted to the evil maid with the first laptop, and your data is unlocked. You would notice, but your data would be exposed.
Now, to be clear, I don't think this negates TPM-sealed disk encryption or TPM-and-PIN sealed disk encryption; they're still meaningfully better than the alternatives (with a passphrase alone, your data is already compromised regardless in this invented scenario, and all scenarios are equally variable to the swiss-cheesiness of UEFI firmware unless it is replaced). But it is a valid model.
What does it matter if it doesn't unlock the disk? It's a different device with a logger. The purpose of the maid is to be evil and steal your pin. The maid has your real device. The only way to prevent this is by you authenticating the device before you enter anything. Look at the heads project (https://github.com/linuxboot/heads).
tpm2totp used to do this, and it also eliminated the need to divulge the secret used to unlock the TPM, I now see that it has not seen a commit in 2 years.
I also hear mjg59 is looking into encrypted swap hibernation support, so there's a slim chance there will be some development on the system-attestation front.
I've used a Tang server to provide encryption keys. Since I don't take my laptop out of my home much, I like the idea that only a passphrase can unlock my machine outside of my home network. It works well for home servers also, and I don't need a bunch of secure boot and storage pcr configs that get mucked up during bios updates.
My model of defense is.if someone is in my house taking all my stuff, I'm probably owned though a smash and grab yields nothing. Plan accordingly for your needs I guess.
To counter some of the (valid) privacy concerns around TPM unlocked FDE, one big benefit is when it comes to decommissioning physically secure machines. If you aren’t concerned about the evil maid scenario and have reason to avoid network based unlocking, TPM unlocked FDE keeps your machines remotely rebootable while still allowing you pull a disk and send it for secure shredding at server EOL. That is to say, if your scenario is “encrypted at rest on a physically secure and trusted server” (more concerned with the storage medium alone), it’s a good fit. It means you’re not reliant on the OEMs opaque secure erase functionality.
I always struggle to understand the point of using disk encryption with TPM, as opposed to the disk encryption with LUKS + passphrase which you remember
With TPM you depend on it so much. What if it breaks? Should I backup the recovery key beforehand? My life has enough keys already Moving the disk to a new laptop also becomes pain
> What if it breaks? Should I backup the recovery key beforehand?
TPM unlocking uses a keyslot in a LUKS container, just like your passphrase does. There are 10 keyslots, so it's not mutually exclusive operation. If TPM doesn't unlock LUKS (as would happen when you put the drive in another device), the bootloader will prompt for a passphrase just like it did before, once entered it will decrypt from another keyslot.
> I always struggle to understand the point of using disk encryption with TPM, as opposed to the disk encryption with LUKS + passphrase
What if you expect the machine to reboot, unattended, after a power outage for instance?
Extraordinary how Linux continues to be 20 years behind Microsoft and Apple when it comes to FDE. This is a hilariously stupid level of complexity for something that should have a universal solution across distros by now.
This is literally a one click process in Windows (plus a couple shell commands to enable TPM+PIN).
I'm not disparaging the author in any way — he's merely documenting the stupidity.
On both my Fedora laptop and on my MacBook, I have to enter a password at boot to unlock the hard drive, and both had similar complexity to set it up (in Fedora I clicked a button and entered a password during the install, on Mac I clicked a button and wrote down a backup key after the install).
I think this is specifically for the TPM2 integration, which isn’t required for FDE. But I assume it makes it smoother. System updates that requires multiple reboots for example are more annoying on Fedora, since every reboot requires re-entering the password, while on Mac I just login after the final reboot.
FDE without TPM requires the passphrase to have as many bits of security as you want the encryption to have. With a TPM you can have something as short as a PIN, since the TPM can limit the rate at which password attempts are made. I assume most users are satisfied with the weak security implied by a short passphrase, but a dedicated attacker could likely crack it.
I mean, Linux has perfectly good FDE - just the user has to type in their password at boot, no TPM involved.
And it's been possible to get Windows-style self-unlocking FDE for 10+ years, such as by using Ubuntu Core - it just costs a bit, and most users aren't willing to pay $$$ to type one less password.
The design of the TPM makes much more sense for a closed-source operating system, where making it impossible to run a non-microsoft-signed OS protects you against rootkits. Open source OSes don't get that benefit, and the remaining benefits are very minor (and come with big downsides) so I can see why open source developers weren't in a hurry.
> The design of the TPM makes much more sense for a closed-source operating system
I don't think that's the case. The great thing about TPMs is that they measure what's on your system. As long as you modify things properly, your changes get measured and stored in the TPM.
Secure Boot is the more closed-sourced way. By default it relies on Microsoft keys unless you enroll your own and sign your stuff.
What problem is this solving though? The post says they're doing this to avoid typing passphrases. Why would you want the private key hidden in the tpm chip of that device? How will you decrypt if the laptop goes bust or if you move the drive elsewhere?
The TPM generates a strong, non-exportable key in hardware that is far less susceptible to brute-force attacks.
As opposed to accidentally creating your own key of "4", for instance.
A PIN can be used to protect the TPM from unlocking. Even if you set a PIN of "1234" — it would still be far more secure if the disk and laptop were ever to become separated, because the TPM will have generated a strong key anyway.
The TPM is basically a smart card soldered to the motherboard.
> How will you decrypt if the laptop goes bust or if you move the drive elsewhere
Windows and Apple both generate a recovery key as part of the enrollment process which you can store offline.
When you format LUKS you can add multiple decryption keys in case the TPM is hosed for some reason like the mobo failing. Can even use a Yubikey instead of a TPM. Or both. Or none. It's really up to you.
That's a minor convenience to not type passphrases and a fairly high risk of you losing the backup key. Not to mention, the entirely separate problem of storing the backup key securely. It doesn't pass the xkcd "correct horse battery staple" test for me.
Do you not have backups? Why do you need to transplant the SSD to a different laptop to access the data using the backup key?
The SSD is also at risk of dying, so you need the backups anyway.
Fedora uses LUKS where your backup key can just be a regular passphrase. A key derivation function is used internally to help with mitigating brute force attacks.
All your arguments amount to "i don't understand why smart cards/yubikeys/etc exist when you can just use passwords"
No, yubikey in the fido/webauthn form protects against phishing/TOTP snooping and replay over the web. TPMs for luks don't. See the other thread about evil maid.
Fairly sure that if the correct GPOs are set, there is no need for any shell commands needed for a TPM PIN enrollment.
Windows and macOS both can do FDE with good UI/UX compared to Linux.
This is 100% correct, my comment was referring to non-domain joined PCs with no policies set.
Doesn't MS use bitlocker? Or did for a long time, and haven't serious vulns been found in it? If so, I'm not even sure it's a valid comparison. One is real encryption the other is crypto-theater.
Also, isn't the insanity due to MS' influence? They were rumored to do this with influencing the UEFI spec, making Linux less desirable because it was so difficult to dual boot or even single boot UEFI when it came out. This conveniently helped windows hold market share (I'm going back to ballmer Linux=cancer days).
It would stand to reason MS would use their influence to make TPMs insane for end users to manage in Linux but a breeze in windows for the same reason. This is presuming we both agree that MS exerts control over hw manufacturers, I think this is clearly the case.
Has nothing to do with distros. This is you encrypting your disk for the kernel to open during boot. It literally prompts you normally when it hits the step where it attempts to mount the main partition. The way Linux does it is far more flexible and secure because the keys aren't sent to some third party and no one can unlock it without your keys. You are free to use anything to sign the LUKS partition besides a TPM or some silly pin like a Yubikey or whatever the hell you want.
It has EVERYTHING to do with distros.
The process is wholly dependent on bootloaders, systemd versions, and a bunch of other version-specific tooling.
Which none of the distros can ever agree on, so there are 50 variations of implementing disk encryption.
If you are worried about privacy, do a FDE, but don't enroll with TPM.
You have no idea what is inside the TPM chip and its vulnerabilities.
On Fedora I implemented TPM2 unlock with strong PCR pins selection with ease. For the ocasional PCR mismatch (on firmware upgrades mostly), I have password, recovery code and even a FIDO2 USB key as options. LUKS2 + Systemd make it so easy to implement. Folks forget that LUKS2 support many unlock slots and methods.
This works equally well on Debian 13, but I found that installing Dracut (which will be the default from Debian 14 onwards) made the whole process smoother.
This is a worse version of my post https://blog.velocifyer.com/Posts/6,How%20to%20set%20up%20se...
Who in their right mind would do this?
For your own safety, don't use TPM! It's most probably like a Trojan horse.
Amen.
I use my tv card and my printer to encrypt/decrypt my harddrives. Best hardware keys ever.
Does this still prevent hibernation from working?
This is still vulnerable to evil maid. You need to be able to attest the system before you enter the PIN.
Sealing to a reasonable subset of PCRs (ie, not just 7 like the article) is reasonably strong against point-in-time evil maid, no?
Like, in Evil Maid Scenario 1, where the Evil Maid only has one-time access, if you've sealed to say 0,2,4,7,9 , or 7 and 15 with a reasonable setup for what gets extended into 15, the Evil Maid's Fake PIN Entry Software would _not_ validate in the secured boot configuration and couldn't actually unseal the TPM, only coerce you into entering your PIN. Then the Evil Maid would have to physically return to your "correct" boot state with the PIN to unseal the disk, no?
(this is all modulo firmware and early boot exploits, of course, since in that case the attestation could also be forged also)
I would call out if it is a solder on TPM (or worse a removable module) MITM attacks work against the TPM. (I don't know why, but apparently new dell servers are still shipping with solder on TPMs and having the BIOS/UEFI firmware measure into that instead of just using the AMD EYPYC CPU's fTPM.) TPM isn't actually going and measuring anything on its own, it just gets PCR extend commands containing hashes sent over from the CPU that it has to trust are meaningful. If you can watch the bus (usually just SPI) it would be trivial to monitor the traffic to the TPM during a reboot and watch the hashes it is expecting to see, at least for the boot artifacts, which could be replayed into the TPM after it is disconnected, and then the TPM would happily unseal the secrets for the attacker's microcontroller, even for sealed secrets they weren't able to watch go past while monitoring. So, IMO against physical access the PCRs aren't doing a whole lot, and the whole thing is resting on a PIN. (Obviously this is a huge problem for servers, where a PIN is probably not in use.)
The maid can just swap out the laptop for a diff one.
A different one ... that you would notice immediately because the PIN would not unlock your disk?
You're in here shitting on TPM but don't seem to understand the threat model at all.
No, I think this is a valid threat model and a good rebuttal. The evil maid steals the original laptop, replaces it with a second laptop with a look-alike PIN entry screen without an attestation. You enter your PIN, it is transmitted to the evil maid with the first laptop, and your data is unlocked. You would notice, but your data would be exposed.
Now, to be clear, I don't think this negates TPM-sealed disk encryption or TPM-and-PIN sealed disk encryption; they're still meaningfully better than the alternatives (with a passphrase alone, your data is already compromised regardless in this invented scenario, and all scenarios are equally variable to the swiss-cheesiness of UEFI firmware unless it is replaced). But it is a valid model.
What does it matter if it doesn't unlock the disk? It's a different device with a logger. The purpose of the maid is to be evil and steal your pin. The maid has your real device. The only way to prevent this is by you authenticating the device before you enter anything. Look at the heads project (https://github.com/linuxboot/heads).
Precisely, exfiltrate the pin, unlock the real one.
tpm2totp used to do this, and it also eliminated the need to divulge the secret used to unlock the TPM, I now see that it has not seen a commit in 2 years.
I also hear mjg59 is looking into encrypted swap hibernation support, so there's a slim chance there will be some development on the system-attestation front.