I’m curious about the possible uses of the hardware Trusted Protection Module for automatic login or transfer encryption. I’m not really looking to solve anything or pry. I’m just curious about the use cases as I’m exploring network attached storage and to a lesser extent self hosting. I see a lot of places where public private keys are generated and wonder why I don’t see people mention generating the public key from TPM where the private key is never accessible at all.

  • SpaceCadet@feddit.nlEnglish
    6·
    11 months ago

    they cannot access the data from software because it is blocked by login screen

    The system may still be vulnerable to over the network exploits. So for example, if the system is running sshd, and a couple of months from now a root exploit is found (à la heartbleed), the attacker may get inside.

    It’s somewhat of a long shot, but it’s still a much larger attack surface than butting your head against a LUKS encrypted drive that’s at rest.

    they cannot access the data from hardware because it is protected by FDE.

    RAM is not protected by FDE. There are (obviously non-trivial) ways to dump the RAM of a running system (Cold Boot attacks, and other forensic tools exist). So if the attacker is dedicated enough, there are ways.

    One of the misconceptions I had before is that I assumed that the disk will be decrypted when you enter the LUKS password. This is not true, the password is loaded into the ram, and only decrypts necessary parts to RAM. All the data on the disk is never decrypted, even when you are working in your OS.

    Hah! That would be impractical :) Imagine having to decrypt your entire 32TB drive array everytime you booted your computer.