1

I'm looking into hardening an embedded device using TPM2 with an encrypted root (/) Linux partition. I've found various articles explaining how to embed LUKS keys into the TPM (eg this one). Unless otherwise informed, I assume this can be secured without encrypting /boot and I believe it's impossible to boot a system with an encrypted EFI partition.

What I'm missing is any discussion of how tools such as systemd-cryptenroll are using the TPM to prevent an attacker simply reading the keys. That is I can't find which information is being checked by the TPM to ensure the OS has not been tampered with in some way.

Just as a TPM cannot protect me if I leave my Linux root password as "root", so too I am concerned that if I make other configuration mistakes I might inadvertently allow an attacker to simply ready the keys from the TPM or otherwise login to the system without providing valid credentials.

What information is a TPM protecting from tampering with Linux?:

  • The boot loader written in EFI (grub EFI stub)?
  • The boot loader config written in EFI (grub.cfg in EFI)?
  • The the boot loader modules and config written in /boot?
  • The kernel parameters like init=/usr/bin/init?
  • The kernel itself?

Unfortunately too many blogs and how-to articles focus on getting the system to boot without user interaction and barely anything on the details of what makes it secure.

1
  • 3
    When you enroll a key in the TPM with systemd-cryptenroll you have to specify to which PCRs to bind it to. For a list of what each PCR measures see this. The TPM can seal a key so that only when the PCRs have specific values the key can be unsealed and used. PCRs values are updated during the measurement process which, with Intel TXT and similar, can make a chain of trust rooted in the CPU microcode. If the bootloader is measured too (as it should), it can unseal the key and keep measuring thereby locking it back Jun 22, 2023 at 17:35

1 Answer 1

0

When you enroll a key in the TPM with systemd-cryptenroll you have to specify to which PCRs to bind it to. For a list of what each PCR measures see this. The TPM can seal a key so that only when the PCRs have specific values the key can be unsealed and used. PCRs values are updated during the measurement process which, with Intel TXT and similar, can make a chain of trust rooted in the CPU microcode. If the bootloader is measured too (as it should), it can unseal the key and keep measuring thereby locking it back

Margaret Bloom

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .