Ubuntu 23.10 Adding Experimental TPM-Backed Full Disk Encryption

[archkde]

Yes, that is the sad truth. Do not use TPM if you don't want your data to be available to 3th persons.

TPM is mostly an availability risk, i.e. you won't be able to read your data if something goes wrong.

[Chugworth]

TPM is mostly an availability risk, i.e. you won't be able to read your data if something goes wrong.

No, the TPM association is added in a separate LUKS key slot and does not replace the password. If the TPM method fails, the password still works.

[Anux]

TPM does not compromise full-disk encryption. Instead, it serves as an additional layer that binds the master key of the disk to the TPM hardware, making offline decryption more challenging. Naturally, a passphrase must still be required.

I didn't know it works that way. So TPM just decrypts a LUKS header and than you decrypt the LUKS container with a password?

But you could just not use TPM and have your classical "password in brain thingy" without loosing security. TPM saves the key on the very hardware it should protect, which means the key gets stolen with the hardware. In case you missed Shnatsels second link, that is compromisable. And it's a closed source black box, so you have to trust companys like Intel or AMD that are famous for horrible hardware vulnerabilitys.

If you want to protect yourself from normal thiefs and police, classic LUKS is more than enough. Else I would like to see the POC brutforce attack on LUKS with argon2id.

Edit: running half of Amazons AWS hardware for a few years at full throttle seems a pretty steep price burdon to me

[Anux]

TPM is mostly an availability risk, i.e. you won't be able to read your data if something goes wrong.

First: If you don't have backups, your data was not important.

Second: See Shnatsels link, looks very much available to me.

[petronio]

I didn't know it works that way. So TPM just decrypts a LUKS header and than you decrypt the LUKS container with a password?

It's still a separate LUKS key (like adding another password), the TPM spec just allows requiring a pin in addition to the usual PCR validation. When setting it up you can do it either with or without pin. TPMs also have lockout periods to protect against brute forcing.

[Jakobson]

I didn't know it works that way. So TPM just decrypts a LUKS header and than you decrypt the LUKS container with a password?

The configuration choice largely determines the security approach. Many users tend to employ TPM as the primary factor, with a password as a secondary option in a separate LUKS slot for backup purposes. For heightened security, the best practice is to combine both the TPM and a password for authentication. Moreover, users may opt for additional keys stored in separate LUKS slots or securely safeguard their LUKS master key elsewhere.

[Anux]

It's still a separate LUKS key (like adding another password), the TPM spec just allows requiring a pin in addition to the usual PCR validation. When setting it up you can do it either with or without pin. TPMs also have lockout periods to protect against brute forcing.

But if TPM directly decrypts your data, than it is basically free for everyone to take and you could have just left the encryption away.

Many users tend to employ TPM as the primary factor, with a password as a secondary option in a separate LUKS slot for backup purposes.

I don't see how this adds any security, what keeps an attacker from just taking the disk and brutforcing the backup keyslot?

For heightened security, the best practice is to combine both the TPM and a password for authentication.

As long as the LUKS header is not encrypted there is no added security, even with 100 password promts.

[archkde]

First: If you don't have backups, your data was not important.

Second: See Shnatsels link, looks very much available to me.

Having to restore from backup counts as reduced availability to me. And you can use TPM with a short password ("PIN") to prevent unattended decryption.

[partcyborg]

First: If you don't have backups, your data was not important.

Second: See Shnatsels link, looks very much available to me.

If you read to the bottom of the article and click on the hackernews link, the first comment explains that his approach only works on bitlocker because it doesn't setup an encrypted tpm session. The linux implementations all do

[Anux]

If you read to the bottom of the article and click on the hackernews link, the first comment explains that his approach only works on bitlocker because it doesn't setup an encrypted tpm session. The linux implementations all do

Fair point, also newer TPMs are on the CPU so you can't just plug in wires and Monitor stuff. But still it's a closed source black box and I would always bet that it gets hacked sooner or later.
It is more a security by obscurity approach and I don't like that, although there might be scenarios where it adds security at least in the short term.