Linux

10001 readers

403 users here now

A community for everything relating to the GNU/Linux operating system (except the memes!)

Also, check out:

Original icon base courtesy of lewing@isc.tamu.edu and The GIMP

founded 2 years ago

MODERATORS

Ategon@programming.dev

anzo@programming.dev

dwraf_of_ignorance@programming.dev

Linux Now Disabling TPM Bus Encryption By Default For Performance Reasons (www.phoronix.com)

submitted 3 weeks ago by cm0002@lemmy.zip to c/linux@programming.dev

22 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] thingsiplay@beehaw.org 20 points 3 weeks ago (10 children)

The intent was on better TPM security after a prior security demonstration showed TPM key recovery from Microsoft Windows BitLocker as well as TPM sniffing attacks.

I am not sure if this is a good change. Isn't this "dangerous"?

The hope is that now it's disabled by default, the Linux kernel developers can spend more time evaluating the security benefits and performance optimizations to make it worthwhile to re-enabled by default in a future Linux kernel version.

I'm confused. They disable security feature and then want spend time on the benefits and performance optimizations, to possible enable it again?

[–] Nomad 7 points 3 weeks ago (6 children)

If you use TPM for signing, that is not an issue most of the time. But if you store decryption keys for a storage device there that's not a good idea.

[–] Mihies@programming.dev 4 points 3 weeks ago (5 children)

Where would you store it then?

[–] Nomad 6 points 3 weeks ago (1 children)

Preferably in your brain and maybe partially in a smart card protected by a pin?

[–] Mihies@programming.dev 4 points 3 weeks ago* (last edited 3 weeks ago) (1 children)

Yes, currently I'm using my brain for that and was thinking a security key such as Yubikey with touch requirement + PIN. But at least on Linux there is no support for that, or is it?

Edit: Ha, there actually is - https://mhdez.com/posts/unlocking-encrypted-linux-with-a-yubikey/

[–] Nomad 2 points 3 weeks ago (1 children)

AFAIK there is. But even if not, it simulates a keyboard which can input your passphrase. Also modification of the initrd is a matter of providing a bash script or binary to launch which returns the passphrase in the crypttab file and adding it to the correct directory.

[–] Mihies@programming.dev 2 points 3 weeks ago

From what I read so far, hardware key is just another way to decrypting, not the required. So it's just a convenient method to avoid typing a (long) password and instead just few PIN chars. So, if somebody gets hold of password, can still decrypt the disk even without the hardware key. Not perfect, but still better than only password.

load more comments (3 replies)

load more comments (6 replies)