Comment on BitLocker encryption broken in less than 43 seconds with sub-$10 Raspberry Pi Pico — key can be sniffed when using an external TPM

fmstrat@lemmy.nowsci.com ⁨1⁩ ⁨year⁩ ago

• baseless_discourse@mander.xyz ⁨1⁩ ⁨year⁩ ago

  LUKS is still vulnerable to this attack if you enable autodecrypt using TPM.

  This attack is based on the vulnerability that the CPU and TPM communicates uses plain text. This attack is not new:

  dolosgroup.io/…/from-stolen-laptop-to-inside-the-…

  SPI is a communication protocol for embedded systems and is extremely common amongst virtually all hardware. Due to its simplicity, there is no encryption option for SPI. Any encryption must be handled by the devices themselves. At the time of this writing BitLocker does not utilize any encrypted communication features of the TPM 2.0 standard, which means any data coming out of the TPM is coming out in plaintext, including the decryption key for Windows

  And apparently Linux is not doing too hot on this regard either:

  As we can see, parameter encryption simply isn’t used in practice, and except for safeboot none of the solutions enforce PIN/MFA by default.

  secura.com/…/tpm-sniffing-attacks-against-non-bit…

  source

  • phoenixz@lemmy.ca ⁨1⁩ ⁨year⁩ ago

    CPU communicates with TPM in plaintext

    Because of course

    source

    • Eufalconimorph@discuss.tchncs.de ⁨1⁩ ⁨year⁩ ago

      CPU doesn’t have any secure storage, so it can’t encrypt or authenticate comms to the TPM. The on-CPU fTPMs are the solution, the CPU then has the secure storage.

      source

      • baseless_discourse@mander.xyz ⁨1⁩ ⁨year⁩ ago

        That make sense, CPU has no place to store private keys, since that is the functionality of TPM…

        Unless there is a firmware solution, which defeats the purpose of a standalone tpm.

        source
• HelloHotel@lemm.ee ⁨1⁩ ⁨year⁩ ago

  I wondered why LUUUUKS didnt use the TPM, why do i have to put my password in… this is absolutely why.

  source

  • cooopsspace@infosec.pub ⁨1⁩ ⁨year⁩ ago

    Also yes you can, I wouldn’t recommend it though.

    source
  • mlaga97@lemmy.mlaga97.space ⁨1⁩ ⁨year⁩ ago

    What exactly is the point of full disk encryption if the system auto-unlocks on boot?

    source

    • rambling_lunatic@sh.itjust.works ⁨1⁩ ⁨year⁩ ago

      Protection against tampering, maybe?

      Bad excuse, but that is the logic I’ve heard.

      source