search

desultory / ugrd

A minimalistic initramfs generator, designed for FDE
GNU General Public License v2.0
31 stars 11 forks source link

TPM2 support for encrypted volumes LUKS or btrfs #76

Open alexminder opened 18 hours ago

alexminder commented 18 hours ago

Does the ugrd support TPM to unseal encrypted volumes? If no, can it be implemented?

desultory commented 9 hours ago

https://github.com/desultory/cattleguard I started working on this. I considered implementing Clevis but haven't figured out the codebase.

There are various ways this can be done, some methods requiring writing to nvram, other methods can bundle "context" within the initramfs.

NVRAM is not unlimited, and including context in the initramfs itself disrupts TPM PCR reads. There are a lot of bad ways to do this, and I personally use a Yubikey on all of my machines, so I don't have a personal reason to add this support.

If anyone wants to add it, or look into it more, I'll be happy to include it, as long as it doesn't work in some way that could potentially hurt user safety.

desultory commented 9 hours ago

https://wiki.gentoo.org/wiki/Trusted_Platform_Module#Create_a_TPM_PCR_policy_for_data_sealing

I think I added this section for the purpose of doing this, if you want to read about the process more.