What do you mean by if nothing has changed? Wouldnt this mean someone could physically steal the machine and then boot it up somewhere else and it’d auto decrypt itself?
Comment on Remote solution to decrypt disk at boot
raldone01@lemmy.world 9 months ago
If you have a TPM you can use secure boot (custom keys) to allow Linux to decrypt itself if nothing has changed.
johntash@eviltoast.org 9 months ago
raldone01@lemmy.world 9 months ago
Yes. That is possible. However if the hardware configuration/software configuration changes the TPM should trip and prevent decryption.
The attackers would have to break you ssh/terminal/lock screen. However code injection should be impossible because you used custom secure boot keys and a ideally signed unified kernel image. (Cant change kernel params without tripping TPM.)
You would not be safe if they did a bus listening attack or if you shell pwd is not safe.
Jean_Mich_Much@jlai.lu 9 months ago
Didn’t know this thing, I will check about that, thanks !