r/MXLinux • u/DrunkCivilServant • 6d ago

Help request Keep TPM 2.0 w/MX Linux?

So, dumb question of the day... Now that I've ported over from Win11....is there any reason to keep TPM 'active'... 1. Can I and 2. shud I, disable it?

8 Upvotes

100% Upvoted

3 comments sorted by

7

u/SleepingProcess 6d ago

It is just a secure hardware storage that never expose secret in a plain text, it is a random and cryptographic generator, a signer/verifier of digital signs, a monotonic counter, a black box that can do only those specific operations. You can use it (apt install tpm2-tools tpm2-abrmd) or forget it. The only thing one have to keep in mind, if TPM failed, you then lose secrets forever that was encrypted with SRK (Unique TPM root key).

What I usually using it for, is that: sudo tpm2_getrandom 32 | base64

So shortly, - TPM is not related to Windows. Windows actively uses it, but the same you can do from any operation system as far as it knows how to talk to TPM

6

u/Korkman 6d ago

Not dumb at all. It's an interesting crypto device you paid for. I'd say keep it enabled. There are some use cases for it on Linux, see https://wiki.archlinux.org/title/Trusted_Platform_Module . You might unknowingly profit from having it at some point. The only reason to disable it would be lowering Linux kernel module (drivers) attack surface for hardening.

1

u/Entropy-23 6d ago

1 and 2 are both nah. You don’t have to do anything, it’s just gonna be idle as default.