News for hackers. Stuff that matters.

A comment on Authenticated Boot and Disk Encryption on Linux. Parent comment

Re:Authenticated Boot and Disk Encryption on Linux by markjenkinswpg on Thursday September 23, 2021 @09:10AM (#28628569)
The solution is to use an HSM such as the Nitrokey/Purism Librem Key (same thing) that has a LED that lights up if boot integrity is fine, including a TPM secret matching (maid can't clone that).

https://www.youtube.com/watch?v=O_3Xf3gTzEE

https://www.youtube.com/watch?v=K1O-33pi33M

https://www.youtube.com/watch?v=SB82Ul_A1js

[ Parent | on HN ]
Re:Authenticated Boot and Disk Encryption on Linux by rcthompson on Thursday September 23, 2021 @09:33AM (#28628880)
This is essentially the same solution, right? It boils down to having a single device that verifies the integrity of everything and never letting that device out of your sight. It's just marginally easier to do that when the device in question is an HSM rather than a laptop.
[ Parent | on HN ]