I have configured a disk encryption in linux using LUKS with TPM with secure boot.
The encryption key is loaded from TPM from NV memory using command TPM_NV_ReadValueAuth.
The problem is that it is read as a clear text and it can be captured on LPC bus with a cheap logical analyser.
My assumption is that the attacker can have physical access to HW and therefore would be able to get the key and decrypt disk.
How to avoid sending clear text key from TPM and avoid eavesdropping or sniffing the key traveling from TPM to RAM?