I've been trying to get a reliable, and decently secure setup on a device for a little while now, and I feel like I may be overthinking some things but I am unsure.
Just to clear things up, this is mostly just for fun, and interest, so I don't exactly have a threat model that I am targeting. I am trying to find the best balance between usability and security.
Currently the setup is like this:
- The laptop has one drive with two base partitions, boot and a dm-crypt/LUKS encrypted volume.
- The encrypted volume has an LVM set up on it with a volume for swap, and root.
- The encrypted volume is unlocked automatically at boot through the use of Intel PTT (Intel's TPM module within the CPU).
- The UEFI/BIOS (including access to the boot menu) is locked with a strong password.
- Secure boot is enabled to prevent unauthorized devices from booting on the system.
The issue that I'm having is that I realize that TPM's are not perfect for securing a system (of course nothing is necessarily perfect, mind you). There are a few simple enough attacks that can compromise them like probing the data lines of the module; however, if I understand correctly, Intel PTT, and AMD fTPM are within the CPU, so I would assume they would be immune to such attacks. However there is still of course the issue of a cold boot attack; once the keys have been released from the TPM, they are vulnerable within the RAM. And with this setup, the keys are released automatically at boot. One solution to this would be to set a boot pin, but I am trying to avoid the mild annoyance of having to input a password on boot.
What I thought might work is to also encrypt the home directory using something like fscrypt (I thought perhaps making a dedicated LUKS home partition would work, but I'm not sure its possible to unlock it at login. Please correct me if I am wrong.) so that at least the personal data is secure in the event of the device being physically compromized. But I would assume that if the device is sleeping, then the keys are still in RAM, and vulnerable in the same way as the drive keys on boot making the home encryption somewhat irrelevent, unless the device is shut down initially. However, it turned out that encrypting the home directory turned out to be somewhat of a pain (unless I am going about it in the completely wrong way) so I am wondering if it is even worth it at all.
Is the setup of just encrypting the root drive the best balance that I am going to strike? Is there any way that I can improve it that I am not aware of?
From all the reading that I have done on this endeavor, it seems that true security must be built in from the ground up, like in the iPhone. There really isn't much way to cobble together a bunch of pieces to get a truly secure and useable system. I would love it if someone could dissuade these thoughts of futility.