I spent several days trying to figure out how to securely decrypt a hard drive on remote location using TPM2.0 in Linux. I'm no security expert and this is my first battle with TPM2.0. I learned a lot, but I still have questions. Could someone help me with those:
- At the current time TrustedGRUB2 does not support TPM2.0, only TPM1.2. I couldn't find other projects with support for TPM2.0. Are there any?
- Can TPM2.0 stop the boot process?
The problem I'm trying to solve is such that:
- I have an encrypted
- The computer will be on someone else premises, so it should not be possible to steal a hard drive and read the data
- The boot process should be unattended -- the machine should not decrypt the drive and boot itself if something changed -- BIOS configuration,
/bootis unencrypted, so fiddling with
I thought about this solution:
- LUKS key will be the value of PCR0
- PCR0 value should change, if someone will change something in BIOS, like reset it (if someone will steal the whole PC, not only the disk), enable USB boot.
- The PCR0 value used to decrypt the disk should be secure as much as secure is the OS running on it -- only way to read this unchanged PCR0 without changing the BIOS is to gain access to the OS, right?
I think that I achieved a level on which I can ask a legitimate question about this issue, but I cannot myself assess further the implications or holes in this.