First, I will explain roughly how I plan to use the TPM:
I am using something called
tpm-luks which stores a key in both TPM NVRAM and adds the key to one of the LUKS keyslots. The initramfs then decrypts the root LUKS-encrypted partition using the key it gets from the TPM. I also use
tpm-luks to seal the key so that the key is released from the TPM NVRAM only when the TPM PCR registers are in a given state (e.g. after a pre-determined bootloader, initramfs, linux etc. have been loaded). TrustedGRUB is used as the bootloader so that it records its own hashes to the TPM PCRs.
I also plan to do remote, unattended upgrades to the system from time to time (e.g. updating the kernel which will also change the hashes of the kernel files etc.). To get around this problem,
tpm-luks provides a way to pre-compute the hashes and reseal the key using the new values before the rebooting the machine so that the key can be unlocked again with the new PCR state.
This process currently requires me to enter the TPM owner password each time I do an upgrade and want to add a new key.
My questions are:
- Is it okay to use the well-known password of 20 bytes of 0s as the owner/SRK passwords?
tpm-lukshas the options to use those well-known passwords to perform these operations so that they can be non-interactive. Since the system is locked down, I am assuming no one will be able to exploit this?
- If not, would it be feasible to keep the passwords on the encrypted root partition? The system is trusted by the time the root partition is decrypted so it should be safe to store the password there (and access it securely)?
- Would it be better to keep the passwords at some other safe location and send them down to the machine if it needs to perform such operations? Not sure if it's any safer than the second option above.
- Are there any other better solutions to accomplish the objectives above (non-interactive storage of keys to TPM NVRAM)?