It all weird still

Suppose the physical attacker doesn't reset the bios. He boots Ubuntu or any other os which is signed. Will the tpm unlock and give out the key? I guess it depends on the setup and it's possible to unlock only on your own signed kernel but I doubt this is a default?

▲

LelouBil 2 days ago | parent | next [-]

I think this is like the windows bit locker vulnerability that was seen a while ago.

The windows recovery put the TPM in the same state as the normal windows OS, so it released bit locker keys, but you could bypass the login on the recovery environment.

▲

vayun 2 days ago | parent | prev | next [-]

At which point they will be stopped by Ubuntu login screen which requires user password (or fingerprint, pin, etc).

Basically there are two options for have to enter 1 password: 1. TPM disk encryption + login password. 2. Password for disk encryption and automatic login (doesn't support multiple user accounts well).

▲

tryauuum 2 days ago | parent [-]

no, I mean the attacker boots his own copy of Windows or Ubuntu, which is supposedly trusted by the UEFI keys. Will tpm somehow detect that it shouldn't unlock secrets for this boot?

▲

noisem4ker 2 days ago | parent [-]

Yes. The PCR state after booting won't match that of the regular system, so the TPM will refuse to give up the key.

	▲	evan_a_a a day ago \| parent [-]
		This is contingent on the sealing policy including PCRs that would change as a result of booting a different operating system, like PCR 11, which, when booting a UKI, contains those measurements. Only sealing against PCR 7 would allow this attack, since the default platform secure boot policy would not need to change.

▲

evan_a_a 2 days ago | parent | prev [-]

The keys can be indirectly sealed against specific system and software configurations such that this attack is not possible. Additionally, as you noted, using custom secure boot keys would prevent the attacker from booting an arbitrary OS.