Yea I was looking at this for work. We require full disk encryption for all operating systems but linux is the one where it's a passphrase or a yubikey. In my personal life it would just make managing my PC more annoying. Imagine a motherboard failure and boom there goes my entire disk.

Yubikeys are very useful. I was pointed to them by a colleague and was a bit skeptical in the beginning but since then I am more than happy to use them, absolutely flawless execution. The only thing that I am a bit concerned about is that it isn't the key that I place on the device that governs all this so you can't be 100% sure that there isn't some kind of supply chain trick that would allow the manufacturer or one or more of their employees to create duplicate keys.

With Linux I think you do have the option of encrypting with your own cert using the PCKS#11 module on the Yubikey.

That's interesting, thank you, I will definitely look into this.

> Imagine a motherboard failure

Hold up, I'm no expert on Secure Boot, but LUKS allows you to have multiple entry keys to the same drive.

This means you can have one key of random gobbledegook which is kept and auto-used by the magic motherboard, and also a passphrase that you can memorize or write down, and either one is totally sufficient on its own.

You don't even need to set them up at the same time, you can start with one and then add the other as an option later.

Secureboot is something else. It verifies the boot loader at the BIOS. This can be broken by the system itself (like if it's hacked). So it's protecting you against modifications to the boot loader. This is where kernel modules can be injected.

TPM 2.0 is something else. It's typically soldered onto the motherboard as a physical device and the key can be generated and then used to encrypt the disk. The private key can not be extracted. Only the signature and you can ask the TPM to sign a binary blob with the private key while providing you the public key to verify. This protects you against physical access to your device. No one can take your disk and decrypt it.

> the key can be generated and then used to encrypt the disk

Right, you can't recover that specific key, but you also don't have to for accessing your data, if you have set up one (or more) alternate keys/phrases before disaster struck.

AFAIK: 99% of your drive is encrypted by a giant fixed unchanging master key, and that is itself encrypted with a non-master key/passphrase, and stored in the "header" 1%. There's room to store multiple copies encrypted with different non-master passphrases.

In that model, the TPM is simply providing its own passphrase and consuming one of those co-equal slots, so having one or more alternates is sufficient to protect your drive from motherboard failure.

You can have automatic unlock with tpm2, with or without a pin, in addition to passphrase, file, fido2, pkcs#11 cert, or whatever else is supported by luks.

I've been using this for a few years now, and never had an issue.

https://wiki.archlinux.org/title/Systemd-cryptenroll

> Imagine a motherboard failure and boom there goes my entire disk.

You can also set a long-ass key in addition to the other methods, and back it up somewhere safe. It works the same as bitlocker: you have key which can decrypt the drive without external help from a TPM in case something goes wrong.

This is actually a super useful summary. Thank you.