| ▲ | tryauuum 2 hours ago | |
I always struggle to understand the point of using disk encryption with TPM, as opposed to the disk encryption with LUKS + passphrase which you remember With TPM you depend on it so much. What if it breaks? Should I backup the recovery key beforehand? My life has enough keys already Moving the disk to a new laptop also becomes pain | ||
| ▲ | theandrewbailey 2 hours ago | parent | next [-] | |
> What if it breaks? Should I backup the recovery key beforehand? TPM unlocking uses a keyslot in a LUKS container, just like your passphrase does. There are 10 keyslots, so it's not mutually exclusive operation. If TPM doesn't unlock LUKS (as would happen when you put the drive in another device), the bootloader will prompt for a passphrase just like it did before, once entered it will decrypt from another keyslot. | ||
| ▲ | drnick1 2 hours ago | parent | prev [-] | |
> I always struggle to understand the point of using disk encryption with TPM, as opposed to the disk encryption with LUKS + passphrase What if you expect the machine to reboot, unattended, after a power outage for instance? | ||