Ubuntu 23.10 Adding Experimental TPM-Backed Full Disk Encryption

[phoronix]

Phoronix: Ubuntu 23.10 Adding Experimental TPM-Backed Full Disk Encryption

As an experimental feature for next month's Ubuntu 23.10 release, Canonical is introducing initial support for TPM-based full disk encryption to make use of your system's Trusted Platform Module (TPM). The downside though is this extra security relies on Snaps, including for the kernel and GRUB bootloader...

https://www.phoronix.com/news/Ubuntu-23.10-TPM-FDE

[szymon_g]

so, will that be based on luks (or something else), or use ext4 (the default fs) features? couldn't the packages be reinstalled into the deb versions (assuming they exist)?

[Shnatsel]

I just hope they won't blunder in one of these incredibly embarrassing ways:

https://pulsesecurity.co.nz/advisories/tpm-luks-bypass

https://www.errno.fr/BypassingBitlocker.html

[Danny3]

What's even the point of using encryption if you are going to use a backdoored hardware device?

[Jakobson]

What's even the point of using encryption if you are going to use a backdoored hardware device?

Company security policy.

[Anux]

Company security policy.

Yes, that is the sad truth. Do not use TPM if you don't want your data to be available to 3th persons.

[C8292]

I just hope they won't blunder in one of these incredibly embarrassing ways:

https://pulsesecurity.co.nz/advisories/tpm-luks-bypass

https://www.errno.fr/BypassingBitlocker.html

happily, fTPM is not affected!

Super happy with this! Finally having a ok-security is almost no user friction!

[Jakobson]

Yes, that is the sad truth. Do not use TPM if you don't want your data to be available to 3th persons.

TPM does not compromise full-disk encryption. Instead, it serves as an additional layer that binds the master key of the disk to the TPM hardware, making offline decryption more challenging. Naturally, a passphrase must still be required.

[Jakobson]

Super happy with this! Finally having a ok-security is almost no user friction!

The only drawback is the dependency on Snap. It may have made it more challenging to boot up with a self-compiled kernel. However, for the average user, this is a brilliant solution that makes enabling full-disk encryption as easy as using BitLocker on Windows.

[anarki2]

What's even the point of using encryption if you are going to use a backdoored hardware device?

The point is that it's not a "backdoored hardware device", only those who wear tinfoil hats think so. You also clearly don't have any idea how it works, the TPM merely provides a convenient way to unlock the disk, without having to resort to secondary passwords, or even worse, USB keys, that will sit permanently in the laptop's bag, or even in the USB port, ironically REDUCING security by having FDE.