Re: [gentoo-user] TPM feature - do I need it?

[Rich Freeman]

On Sun, Nov 30, 2014 at 4:41 AM, Mick <michaelkintzios@×××××.com> wrote:
>
> OK, but as I understand it although I can set up a passhphrase for the private
> key stored by the current oligopoly of manufacturers in a TPM, I can't extract
> it from the TPM. Would this mean that I will have no means of decrypting my
> drive, if I lose the TPM hardware module (e.g. due to hardware failure, fire,
> theft, etc.)?  Access to my data will then become conditional on my having
> access to this unique TPM piece of silicon and its manufacturer's installed
> key, besides any private key passwd that I would have set up.

I'm not an expert on TPM, but I suspect you could generate the key
outside the TPM, save a copy somewhere safe, and then load the key
into the TPM and secure it.

>
> Hmm ... I wonder if dm-crypt, LUKS and friends are a better way to achieve
> data protection for Linux users, without using some manufacturer's suspect
> certification credentials.

Encrypting a hard drive does not require trusting any key/certificate
issued by a manufacturer.

The advantage of using a TPM is that you can secure the drive without
requiring a boot-time key to unlock the drive.  This would be
particularly useful if the system runs daemons that you might want to
have run without anybody logging in.  Also, using LUKS/etc requires a
manually-entered key which will always be limited in entropy
(mitigated using multiple rounds typically).

The TPM is most useful in corporate environments though, since it
doesn't require the PC owner to trust the PC user to not lose the
key/etc.  The whole point of the TPM is to reduce the risk of somebody
who has physical possession of a machine compromising its security.
In the corporate environment, the system owner often doesn't have
physical control over the machine, and doesn't want to tell the user
the encryption key which they can then proceed to write on a post-it
stuck to the laptop.  Those concerns apply just as much to a linux
desktop as a windows one.  Sadly, only ChromeOS really seems to take
advantage of these capabilities in the linux desktop world.

The whole Trusted Computing thing tends to turn off a lot of the linux
community, much like UEFI is associated with thinks like unrootable
devices.  However, when used PROPERLY they're great tools.  It is
wrong for a device manufacturer to prevent a device owner from rooting
a device they own.  On the other hand, it is a great feature for a
device owner to be able to prevent somebody who steals the device from
being able to root it, or to block malware.  The key is to keep
control in the hands of the legitimate owner.

--
Rich