this post was submitted on 26 Apr 2025
38 points (91.3% liked)
Linux
53623 readers
1777 users here now
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Rules
- Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
- No misinformation
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
You are quite mistaken. TPM is used as a key pair, and not just generation.
Let give you a specific example: built a hardware platform for a company, and they wanted to make sure that the storage and device were secure on their own, as well as being separated to prevent somebody pulling it apart to try and channel attack all the different things.
On install, the encrypted disk generates a signature. TPm has its own clean keys set to verify that it's paired at various levels with various pieces of onboard hardware. Then you pair a bootloader combination of those signatures to generate a three-part signature to make sure that what is in TPM matches both the onboard signatures of what is hardwired in, along with the key generated by the new encrypted volume on the drive.
Anyone takes that drive out, it's mostly useless, because it can't boot without the signatures verified by TPM, and they'll never be able to match the combination of the other 15 keys stored there for the hardwired components.
That's how it's intended for use. Not just for signature generation and verification. It's more of a key/value store than anything, like a physical hardware token device.
Cool story bro. And I am one of the 9 people that worked on the team at Intel to implement your modern EFI/UEFI.
I just don’t have the time or energy to sit here and explain the whole fucking stack to a bunch of people who mostly could care less. But, Secureboot, it’s a good thing, and the tools on linux get better every hour. Check out lanzaboote.
https://github.com/nix-community/lanzaboote