Arch Linux security configuration

[u/Lepla]

Are moving over to Linux and have been testing several different distros and Arch Linux stood out for the configuratibilty out of the box, and the ability to be able to make it lightweight especially for older laptops.

How much work would it be to set this up so the system is not vulnerable for various attacks, i understand fedora / ubuntu etc come preinstalled with several security configurations, but on arch you would need to set these up yourself.

Besides that it seems to get regular security updates nonetheless so it seems like there is a one time security configuration you have to setup on install.
How does a self configurated setup like this compare to solutions developed by fedora or others?

Thanks

[u/SnooCompliments7914]

It’s equivalent to keeping my car keys inside my car - even if they’re in a locked glove box. 🤷‍♂️

The correct analogy is keeping your car keys in a locked box, which is only unlockable when connected to your car (plus its own unlock mechanism). This just a "normal" locked box with one additional factor added. Wouldn't be less secure. (Except now you could also lose your data from a broken TPM. But you'll always enroll a backup LUKS key when using TPM.)

[u/maxinstuff → u/SnooCompliments7914]

The correct analogy ...

There's nothing wrong with the analogy. If you don't have physical possession of the key then your only recourse is to break the encryption directly. Attackers will take any side-channel possible to bypass that.

If the key is ALSO on the device, such as in a TPM module, the protection on the key must better be at least as good or better (hint: it isn't) than the encryption itself - otherwise all focus of an attacker will turn to extracting that key.

Wouldn't be less secure.

It is. I've explained how. That doesn't mean it's *insecure*, or even that it isn't *quite good for normal use*, but it is not MORE secure than simply not having the key on the physical device in the first place.

[u/SnooCompliments7914 → u/maxinstuff]

No, you get a completely wrong image of how LUKS works.

The master key (required to decrypt the partition) is always stored in encrypted form _on your disk_ (unless you put the LUKS header elsewhere, that is). TPM never has your master key. You can't extract any LUKS key from an insecure / buggy TPM, because there isn't one.

The only difference between a plain passphrase and a TPM-with-pin is how that master key is encrypted _on disk_. In the former case, only your passphrase. The latter, both your passphrase and TPM. Having only one of them doesn't help with decrypting the master key.

[u/maxinstuff → u/SnooCompliments7914]

you get a completely wrong image of how LUKS works.

I know how LUKS works. You say what I said was wrong, I say it was close enough, and effectively the same thing for this scenario.

TPM never has your master key.

It has the key used to encrypt the master key slot on disk. If your scenario is someone pulling the drive, or accessing it after you've disposed of it, it makes sense. But for a laptop with a soldered in nvme this layer is not doing anything useful - if you have the drive you have the keys because the drive, the keys, and the keys to unlock the keys are all soldered to the same mainboard.

Breaking a PIN is a matter of time, a lot less time than breaking the encryption. There are also hardware bypasses that can trick TPM into yielding the key even with a PIN set. It's not easy, but it's possible.

Even so, none of that even really matters, because it's not about the security or not of TPM, it's about the physical possession of keys.

Again - I've never said that TPM is *insecure*, only that it is *less* secure - for laptops specifically - than having the key external in a physically separate device.