A report from the 2022 Image-Based Linux Summit

Posted Nov 4, 2022 6:06 UTC (Fri) by NHO (guest, #104320)
Parent article: A report from the 2022 Image-Based Linux Summit

This solves technical problem of security from third party, in cool way.
What happens if motherboard in my laptop died from coffee-related accident and I need to extract data from my SSD that was automatically encrypted without asking me on installation, with keys stored in dead motherboard?
Proposal also does nothing to even address the fairly important legal problem: what if vendor decides that I am also third party, not permitted to meddle with software on my personal computer, and their ownership of root keys entitles them to extract wealth from me for the right to use hardware I own with software I own, until they decide that my hardware is not worth supporting and disable all software on it by the means of short-lived crypto cert?

A report from the 2022 Image-Based Linux Summit

Posted Nov 4, 2022 6:50 UTC (Fri) by zdzichu (subscriber, #17118) [Link]

Well, restore from backup, of course!

A report from the 2022 Image-Based Linux Summit

Posted Nov 4, 2022 7:51 UTC (Fri) by smurf (subscriber, #17840) [Link]

Presumably the home partition is encrypted with LUKS. LUKS can store more than one key, so one is in your TPM, one is a passphrase encrypted by a secret on an USB stick, and one is on a MicroSD card that's hidden in your safe.

Not to mention your encrypted backups.

A report from the 2022 Image-Based Linux Summit

Posted Nov 4, 2022 9:52 UTC (Fri) by bluca (subscriber, #118303) [Link] (2 responses)

systemd-cryptsetup/cryptenroll support recovery keys (even as a QR code! It's really cool, you should try it out) that can be used as additional slots in LUKS, so offline recovery is possible and as easy as it can be made.

There is no such "legal problem", this scare story has been around for 20 years since UEFI first arrived, and guess what, it never happened, because it does not make any sense. The UEFI spec mandates that the machine owner, with verified physical presence at the keyboard, can swap the keys.

A report from the 2022 Image-Based Linux Summit

Posted Nov 4, 2022 11:34 UTC (Fri) by aragilar (subscriber, #122569) [Link] (1 responses)

I may have misunderstood something, but is not https://mjg59.dreamwidth.org/59931.html an example?

A report from the 2022 Image-Based Linux Summit

Posted Nov 4, 2022 11:42 UTC (Fri) by bluca (subscriber, #118303) [Link]

No, there's an option in that bios to turn the 3rd party UEFI cert back on, and the usual option to wipe the lists of certs and enroll your own.
Of course the user experience given by the default settings sucks, and it is being worked on. But it has nothing to do with this.