latchset
Support for TPM key password
Hello,
I just found clevis while researching alternatives to LUKS unlocker that utilizes TPM.
One thing that I noticed is that clevis does not support TPM PIN as in BitLocker (note that "PIN" here means short number that is needed to unlock TPM key with addition to PCRs. That PIN protects against brute-force attacks).
luks-tpm2 uses TPM parent key password for this.
Why is it imporant? To protect against unauthorized extracting of TPM keys.
Hello, I've also been tracking this feature request for a while. Just wanted to point out that since this issue was created, tpm2-totp came to be, and it addresses a major drawback of simple PIN protection -- it allows attestation of the system before inputting the PIN and thus releasing the disk encryption key (e.g. to be logged by a counterfeit initrd).
All I'm saying is that maybe it's too late to spend effort on implementing this and we should move on to better and more secure solutions.
