What problem is this solving though? The post says they're doing this to avoid typing passphrases. Why would you want the private key hidden in the tpm chip of that device? How will you decrypt if the laptop goes bust or if you move the drive elsewhere?

▲

lakeviewterrace 3 hours ago | parent [-]

The TPM generates a strong, non-exportable key in hardware that is far less susceptible to brute-force attacks.

As opposed to accidentally creating your own key of "4", for instance.

A PIN can be used to protect the TPM from unlocking. Even if you set a PIN of "1234" — it would still be far more secure if the disk and laptop were ever to become separated, because the TPM will have generated a strong key anyway.

The TPM is basically a smart card soldered to the motherboard.

> How will you decrypt if the laptop goes bust or if you move the drive elsewhere

Windows and Apple both generate a recovery key as part of the enrollment process which you can store offline.

▲

hparadiz 3 hours ago | parent | next [-]

When you format LUKS you can add multiple decryption keys in case the TPM is hosed for some reason like the mobo failing. Can even use a Yubikey instead of a TPM. Or both. Or none. It's really up to you.

▲

bubblethink 3 hours ago | parent | prev [-]

That's a minor convenience to not type passphrases and a fairly high risk of you losing the backup key. Not to mention, the entirely separate problem of storing the backup key securely. It doesn't pass the xkcd "correct horse battery staple" test for me.

▲

drdexebtjl 2 hours ago | parent | next [-]

Do you not have backups? Why do you need to transplant the SSD to a different laptop to access the data using the backup key?

The SSD is also at risk of dying, so you need the backups anyway.

▲

rlpb 2 hours ago | parent | prev | next [-]

Fedora uses LUKS where your backup key can just be a regular passphrase. A key derivation function is used internally to help with mitigating brute force attacks.

▲

lakeviewterrace 3 hours ago | parent | prev [-]

All your arguments amount to "i don't understand why smart cards/yubikeys/etc exist when you can just use passwords"

	▲	bubblethink 2 hours ago \| parent [-]
		No, yubikey in the fido/webauthn form protects against phishing/TOTP snooping and replay over the web. TPMs for luks don't. See the other thread about evil maid.