Linux 6.10 Adding TPM Bus Encryption & Integrity Protection

[phoronix]

Phoronix: Linux 6.10 Adding TPM Bus Encryption & Integrity Protection

Linux 6.10 is introducing support for Trusted Platform Module (TPM2) encryption and integrity protections to prevent active/passive interposers from compromising them. This follows a recent security demonstration of TPM key recovery from Microsoft Windows BitLocker being demonstrated. TPM sniffing attacks have also been demonstrated against Linux systems too, thus the additional protections be made with Linux 6.10 to better secure TPM2 modules...

https://www.phoronix.com/news/Linux-610-TPM-Encrypt-Integrity

[Jedibeeftrix]

is this part of suse's work to bring tpm fde with btrfs snapshots?

[jacob]

is this part of suse's work to bring tpm fde with btrfs snapshots?

Sorry have you got some pointers about that? I don't understand what you mean. Btrfs snapshots work perfectly with fde as it stands today, if the encryption keys were stored in the TPM that wouldn't change anything as far as btrfs is concerned.

[Jedibeeftrix]

https://microos.opensuse.org/blog/2023-12-20-sdboot-fde/

pre-req's:
systemd 256 - pcrlock
yast - sdbootutil
grub - bls

[AdelKS]

So I assume TPMs actually supported encrypted exchange over the BUS all along and it just wasn't implemented ?

[brent]

So I assume TPMs actually supported encrypted exchange over the BUS all along and it just wasn't implemented ?

Correction: BitLocker doesn't use it. systemd-cryptenroll for instance uses it for quite some time already.

I'm not actually sure what this merge request is all about, could be a transparent parameter encryption mode.

[EphemeralEft]

Correction: BitLocker doesn't use it. systemd-cryptenroll for instance uses it for quite some time already.

I'm not actually sure what this merge request is all about, could be a transparent parameter encryption mode.

I think kernel-space also uses the TPM for some things.

[Anux]

Imagine saving your password on the same device you encrypted, it's just destined to fail.

I think kernel-space also uses the TPM for some things.

I don't think so, I have TPM disabled in BIOS and everything still works as intended.

[EphemeralEft]

I don't think so, I have TPM disabled in BIOS and everything still works as intended.

I’m not saying the kernel needs a TPM, but if a TPM is present then it uses it.