TPM HMAC Encryption Being Pulled Back To x86_64 By Default For Linux 6.10

Written by Michael Larabel in Linux Security on 28 May 2024 at 08:54 AM EDT. 16 Comments
LINUX SECURITY
One of the new security features coming with Linux 6.10 is TPM bus encryption and integrity protection to fend off a wave of possible attacks against Trusted Platform Module recovery keys, TPM sniffing, etc. This functionality was merged for the Linux 6.10 merge window but is now being pulled back to x86_64-only by default where it's been sufficiently tested.

Following that initial merge request where the new TCG_TPM2_HMAC knob was enabled by default, it was suggested that it be disabled by default over concerns over the performance implications of this TPM encryption. It was then suggested to limit it to just ARM64 and x86_64 architectures by default. Now in pull request form, it's been pulled back to just flipping on this security feature by default for Linux x86_64 systems where it's been sufficiently tested. And modern x86_64 AMD/Intel hardware is fast enough to cope with the encryption overhead.

TPM module


This pull request today for Linux 6.10 is what's limiting TCG_TPM2_HMAC by default for just x86_64 systems now. Those on other architectures can still manually opt-in to enabling this TPM encryption functionality for better security and with time after sufficient testing/analysis will likely be enabled by default on more CPU architectures.
Related News
About The Author
Michael Larabel

Michael Larabel is the principal author of Phoronix.com and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 20,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and OpenBenchmarking.org automated benchmarking software. He can be followed via Twitter, LinkedIn, or contacted via MichaelLarabel.com.

Popular News This Week