Bootstrapping a slightly more secure laptop [video]

Re:Bootstrapping a slightly more secure laptop [video] by nickik on Sunday January 08, 2017 @07:57AM (#13349517)

What would be really interesting is to use this with a UAF/U2F. The TPM produces a value, this value could be used the same way the domain name gets used in 'normal' UAF/U2F (as the AppID). The UAF/U2F authenticator would only sign the challenge if the TPM is correct, saving you from the Evil Maid attack. This the same mechanism that protect from phishing in the web.

Then you can validate the signed token, and if everything is correct you can use the TPM value to decrypt the harddisk.

Right now I am using my remembered password plus static password mode of my Yubikey to have a fake 2FA decryption requirement on boot but UAF/U2F would be way cooler.

It there something wrong with this idea?

[ Parent | on HN ]

Re:Bootstrapping a slightly more secure laptop [video] by watersb on Monday January 09, 2017 @08:30PM (#13361739)

Essentially no, you are not wrong.

I am working on setting up a system with a YubiKey 4 in this way. Apple FDE can accept a certificate for verification. Or simply the password.

I haven't set up LUKS like this in a long, long time. But I will get there soon..

[ Parent | on HN ]