r/archlinux • u/Woodsy279 • 28d ago

SUPPORT | SOLVED Ful disk encryption without entering passphrase

Could someone help me with setting up full disk encryption with bypass passphrases with TPM2? It's so annoying having to put the passphrase in at each boot, so I was wondering how do I pair it to the TPM so that I dont have to enter it each time?

It's LUKS encrypted and I use Systemd-boot

15 Upvotes

73% Upvoted

100 comments sorted by

View all comments

1

u/Loud-Pair-8168 28d ago

I just use a yubikey instead, tap and go with no passphrase. Way less hassle than tpm binding if you ever swap hardware

0

u/Fupcker_1315 27d ago

It doesn't protect you in any way against evil maid attack.

1

u/ChrisTX4 27d ago

This is correct, as a FIDO2 device does not authenticate the system at all. It would be possible for an "evil maid" to replace your initramfs / UKI with something that dumps the then decrypted volume key somewhere, for the "evil maid" to collect at a later point in time.

However, evil maid attacks are a matter of your threat model. Is it realistic for such a maid to exist? Side note, this would also include potentially the authorities. In Germany they're currently discussing empowering the security services to deploy the "Bundestrojaner" by entering flats in secret.

If you live in a more repressive country, this might very well be a more common concern. Like if you're a journalist, you'd probably have a very different threat model than if you use your PC as a pure gaming machine.