News for hackers. Stuff that matters.

A comment on AMD's Firmware TPMs Vulnerable to Hardware Attacks, Defeating Disk Encryption. Parent comment

Re:AMD's Firmware TPMs Vulnerable to Hardware Attacks, Defea... by dhx on Tuesday May 02, 2023 @10:57AM (#35788471)
It could also be a concern for Linux users if they have configured their system to use systemd-cryptenroll (even with --tpm2-with-pin=yes or --fido2-with-client-pin=yes). The user is not asked for a secure passphrase in addition to having a TPM present. The user is just asked for a short PIN that is provided to the TPM2 or FIDO2 device and the device is not meant to return the secret without a valid PIN being provided.
[ Parent | on HN ]
Re:AMD's Firmware TPMs Vulnerable to Hardware Attacks, Defea... by hnj2 on Tuesday May 02, 2023 @01:53PM (#35791557)
There is actually an interesting point regarding TPM+PIN and systemd-cryptenroll: The data sealed in the TPM can directly be used to decrypt the disk (it is base64 encoded and used as a passphrase for a luks key slot). The PIN is only used to authenticate the TPM's unsealing of the data. In contrast, the unsealed BitLocker data still needs to be decrypted with the pin to get to the VMK.

When our attack is successfully executed on a target, this means that TPM+PIN is broken on systemd-cryptenroll, and as secure as PIN-only with the same PIN on BitLocker.

[ Parent | on HN ]