33
Can you make Pop!_OS disk encryption use TPM?
(lemmy.world)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 19 Feb 2024
33 points (97.1% liked)
Linux
48080 readers
761 users here now
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Rules
- Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
- No misinformation
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
founded 5 years ago
MODERATORS
This person asked if they can make PopOS secure via TPM.
I am saying that while yes, you can, there isnt much point, because setting up LUKS to work with TPM is inconvenient, easy to fuck up, and basically offers no additional protection against all but extremely implausible security scenarios for basically everyone other than bladed server room admins worried about corporate espionage who are for some reason running bare metal PopOS on their server racks.
Like the only actual use case I can see for this is /maybe/ having a LUKS encrypted portable backup drive, but even then you can still base the encryption key in the actual main pc's harddrive without using tpm, though at /that and only that point/ are we approaching parity between the difficulty of using or not using tpm to accomplish this.
You didn’t know you could use it 30 minutes ago. It seems like you don’t know how it’s set up, what protection it does or does not offer, what the use cases might be, nor where any vulnerabilities may be. I’m wondering why you remain actively involved in the conversation with an opinion rather than sitting back and learning something new.
It offers convenience of not putting in an encryption passphrase at every boot, with reasonable security against a lost or stolen machine that nobody can just boot up a live usb and access the data. Its end-user behavior is like every other consumer operating system.
I think it even increases the security by not asking for the passphrase. Because the moment it asks, you know your machine has been tampered with and that you should be alert.
You don't seem to understand how TPM works at all. You cannot extract keys from the TPM, it provides protection against any attack that involves removing the hard drive from the computer it is installed in. This is not like storing an encryption key on a USB drive, as you seem to think. I recommend you actually do some reading on TPM before you attempt to talk with any authority. I don't personally think it's a great solution (for me, at least), but not for any of the reasons you've listed in your comments.
You can't use TPM-based encryption on a portable drive, that isn't even possible. That's exactly the point of TPM to begin with. You know, the whole Trusted Platform Module? That exists to ensure your hard drive (or whatever other use you have for the TPM) cannot boot or be read by any machine other than the one it was set up with. That's the entire premise of establishing a root of trust. What are you on about?
Please, read about how TPM works.