This website contains age-restricted materials including nudity and explicit depictions of sexual activity.
By entering, you affirm that you are at least 18 years of age or the age of majority in the jurisdiction you are accessing the website from and you consent to viewing sexually explicit content.
LUKS is still vulnerable to this attack if you enable autodecrypt using TPM. This attack is based on the vulnerability that the CPU and TPM communicates uses plain text. And it is a pretty common attack against TPM:
https://dolosgroup.io/blog/2021/7/9/from-stolen-laptop-to-inside-the-company-network
And apparently Linux is not doing too hot on this regard either:
https://www.secura.com/blog/tpm-sniffing-attacks-against-non-bitlocker-targets
However, this attack is not viable for device with firmware based solution, like fTPM, Microsoft Pluton, secure enclave etc. in these case TPM is part of the cpu, hence have no exposed pins to sniff their connection.
So if you don’t want people with physical access to your computer (a thief or a evil maiden) to access everything on your disk, don’t setup TPM auto decrypt.
Because of course
CPU doesn’t have any secure storage, so it can’t encrypt or authenticate comms to the TPM. The on-CPU fTPMs are the solution, the CPU then has the secure storage.
That make sense, CPU has no place to store private keys, since that is the functionality of TPM…
Unless there is a firmware solution, which defeats the purpose of a standalone tpm.
deleted by creator