What about TPM

[Okazakee]

When all major issues are solved or most solved, it would be awesome to get a wiki page dedicated to LUKS or other similar sw and TPM protection guides. I guess not all distros can do this easly, but if this repo gets more hype maybe some people will take care of contributing for their major dist.

[Myaats]

I can confirm systemd-cryptenroll w/ TPM works fine and can unlock LUKS if the distro loads systemd in initrd.

It's not much harder than systemd-cryptenroll [luks disk] --tpm2-device=auto --tpm2-pcrs=[pcrs] and adding tpm2-device=auto to the crypttab for the luks disk.

The pcrs are documented in https://www.freedesktop.org/software/systemd/man/systemd-cryptenroll.html. These are useful if you want to invalidate the ability to unlock from TPM if secure boot is off, there are major hardware changes or the BIOS has updated.

[Okazakee]

Can someone tell me if using good pcrs choices ensures no one can do that stupid attack? I'm not sure I understood what that user replied correctly...

[Myaats]

You could just use PCR 12 with systemd-boot and secure boot (PCR 7), as long as the path to the kernel is static not even updates should break it, but as soon as someone adds a new boot parameter to the kernel TPM unlocking should fail and it will in theory fallback to password unlocking, I have not tried this so I can not guarantee this is correct.

[Okazakee]

I noticed while trying fedora 37 iso that on security panel my laptop does not reach neither of 3 levels. There was the encrypted ram, amd rollback, and another one. Is there something I can do to fix or enable these features?

[ghost]

You can enable AMD FAR Rollback protection using Smokeless EFI Patcher and this CONFIG with

Op Patch Pattern E33545B0043046499EB714942898305300000000 E33545B0043046499EB714942898305301000000

added. But Be careful, once FAR is active, there is no going back as AMD uses a E-FUSE in the CPU.

I have activated it, but if Lenovo decides to deliver a downgraded AMD AGESA version (highly unlikely,but still) the Laptop wont post anymore.

[Okazakee]

You can enable AMD FAR Rollback protection using Smokeless EFI Patcher and this CONFIG with

Op Patch Pattern E33545B0043046499EB714942898305300000000 E33545B0043046499EB714942898305301000000

added. But Be careful, once FAR is active, there is no going back as AMD uses a E-FUSE in the CPU.

I have activated it, but if Lenovo decides to deliver a downgraded AMD AGESA version (highly unlikely,but still) the Laptop wont post anymore.

This is golden info and should be put to the wiki, thanks a lot. Are there any real concerns on wanting to enable this? What are the scenarios on which this might be really useful, even if unlikely possible. Thx anyway

[ghost]

Regarding the usefulness, this really is a low level security concern, which means it does help the most against a physical attack. So lets say AMD releases new firmware because the older version has security vulnerabilities and you flash it without AMD FAR, now an attacker with physical access (it could also be possible via a remote attack and without external hardware, albeit with elevated access) to the machine could flash the older version via a external SPI flasher and use those vulnerabilities to start an attack on your machine.

The possible concerns is if Lenovo rolls out a BIOS update (and you flash the newer BIOS version) and for some reason has decided to downgrade the included AMD firmware, the machine no longer posts. It is not really likely that Lenovo would downgrade included firmware with an BIOS Update, but still it could happen. And if this is the case, only a recovery flash with the old BIOS which includes the higher AMD firmware Version would again allow the laptop to post.

[Okazakee]

So if someone is crazy to the right point, it could use some hw to pin the bios chip and clone before updating, then it should be possible to rollback if you have the signed bios copy, or am I missing something? Either way, I'll wait a bit for now, when I study this stuff more I might decide to do that painlessly

[ghost]

The actual rollback prevention is done directly in the SOC via an E-Fuse. On every update, the bios burns a new value into the SOC and saves it permanently. If the AMD firmware somehow is a lower version than burned to the SOC, the CPU will stop the boot process and terminate. So you would have to replace the CPU in order to disable AMD FAR, which means you would erase and remove all the cryptographic keys as well.

It secures your PC against many hardware attack vectors, but as i said, for most people it is really not necessary, so i would not recommend activating it for now.

I will see if Lenovo decides to rollback the AMD firmware with a BIOS update sometime and brick my laptop temporarily.

[Okazakee]

I would feel safe knowing that themselves activate that, at least you would know they won't push older version of that