Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is it possible to use TPM for storage of some private key? It's not a full-disk encryption , I want it to be compatible with existing LUKS, just add another key, and store it in the TPM.

share|improve this question

2 Answers 2

Try tpm-luks [1], which is a script that will assist in storing a new secret both in the TPM's NVRAM and a LUKS key slot.

This should do the trick:

$ tpm-luks -c -d <device>

You can find your LUKS device with:

# blkid -t TYPE=crypto_LUKS

I released tpm-luks very recently, so its only available in git ATM.

[1] https://github.com/shpedoikal/tpm-luks

share|improve this answer

From what I know, nothing prevent this in practice, but the code was not written yet. You can take a look however on http://publib.boulder.ibm.com/infocenter/lnxinfo/v3r0m0/index.jsp?topic=%2Fliaai%2Fecrypts%2Fliaaiecryptfs.htm

The idea is use tpm_sealdata to encrypt a file, and then this can be unlocked only if the boot was not fiddled with.

You may need to use a patched version of grub, called trusted grub. I do not think this was integrated into grub2.

Once the file is unlocked, you can feed it as a key to cryptsetup and if it fail, run the regular "ask the password" dialog, thus permitting to boot if the hardware was fiddled. But of course, that would mean the system would boot without password by default.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.