(1/2)

#Linux #DiskEncryption question for the masses. I want to check that I'm thinking about this the right way. Context is a laptop with a #LUKS partition.

I see a lot of how-to articles floating around about using #tpm2 for LUKS decryption on device boot.
I understand that this gives convenience over a separate passphrase for decryption and still prevents:

1. An adversary from removing the hard drive when your machine is off and decrypting it (because the adversary won't have the TPM to decrypt).

2. An adversary from modifying anything in the secure boot chain and accessing a decrypted drive (because the device will then refuse to boot and decrypt the LUKS partition).

This Unpatchable Flaw Affects All Intel CPUs Released in Last 5 Years https://thehackernews.com/2020/03/intel-csme-vulnerability.html #intelvulnerability #fastestprocessor #diskencryption #intelprocessor #cybersecurity #encryption #IntelCPU #TPMChip