Let’s say you have LUKS with TPM enabled. Verified or Safe Boot is also on, so someone cannot access your decrypted files just with some live usb distro. And let’s say you also have a password set for changing BIOS/UEFI settings so the attacker cannot disable safe boot without a password. So the attacker might want to steal the hard drive in this case to get the data, but that’s also not possible because the hard drive is encrypted and the key is in the TPM. The way TPM also checks for integrity makes the system tamper-proof. So any attempt at tampering with the hardware will trigger the tamper protection and ask the user for a recovery passphrase to let the TPM hand over the decryption key again. So actually TPM is useless without safe boot and without a password for the user account in your OS. The only thing protecting your data from the attacker in this case is your user password… unless the user has one of these raspberry pi pico devices that are programmed to take the TPM keys sent to the CPU at boot in plaintext. Though I am pretty sure this is also fixed or will be fixed in the future. Maybe public key cryptography could help. I haven’t researched that yet.
TL;DR: TPM is pretty useless without safe boot, but is pretty decent with safe boot. TPM is not the securest thing in the world but for a regular user it’s probably the best choice without sacrificing convenience.
Just wanted to add that your BIOS password can be circumvented by taking out the CMOS battery. That will clear all your settings and allow unrestricted access. A BIOS password should absolutely never be used as a form of security, it is trivial to bypass.
Granted, I don’t believe that the TPM will give the key if secure boot were disabled, I just wanted to mention that BIOS passwords don’t do anything against any real attack.
I also want to add that the TPM will request the recovery key if the BIOS goes back to factory defaults. I also think changing the secure boot setting might trigger it. If that’s the case then a BIOS password is pretty useless.
I believe that the TPM will refuse to provide keys after secure boot is disabled, but I didn’t intend to imply that it could be used to bypass TPM decryption or anything. Just as an aside that BIOS passwords are effectively useless at preventing access to the BIOS.
Let’s say you have LUKS with TPM enabled. Verified or Safe Boot is also on, so someone cannot access your decrypted files just with some live usb distro. And let’s say you also have a password set for changing BIOS/UEFI settings so the attacker cannot disable safe boot without a password. So the attacker might want to steal the hard drive in this case to get the data, but that’s also not possible because the hard drive is encrypted and the key is in the TPM. The way TPM also checks for integrity makes the system tamper-proof. So any attempt at tampering with the hardware will trigger the tamper protection and ask the user for a recovery passphrase to let the TPM hand over the decryption key again. So actually TPM is useless without safe boot and without a password for the user account in your OS. The only thing protecting your data from the attacker in this case is your user password… unless the user has one of these raspberry pi pico devices that are programmed to take the TPM keys sent to the CPU at boot in plaintext. Though I am pretty sure this is also fixed or will be fixed in the future. Maybe public key cryptography could help. I haven’t researched that yet.
TL;DR: TPM is pretty useless without safe boot, but is pretty decent with safe boot. TPM is not the securest thing in the world but for a regular user it’s probably the best choice without sacrificing convenience.
Just wanted to add that your BIOS password can be circumvented by taking out the CMOS battery. That will clear all your settings and allow unrestricted access. A BIOS password should absolutely never be used as a form of security, it is trivial to bypass.
Granted, I don’t believe that the TPM will give the key if secure boot were disabled, I just wanted to mention that BIOS passwords don’t do anything against any real attack.
I also want to add that the TPM will request the recovery key if the BIOS goes back to factory defaults. I also think changing the secure boot setting might trigger it. If that’s the case then a BIOS password is pretty useless.
I believe that the TPM will refuse to provide keys after secure boot is disabled, but I didn’t intend to imply that it could be used to bypass TPM decryption or anything. Just as an aside that BIOS passwords are effectively useless at preventing access to the BIOS.
It does seem like most of the TPMs indeed do not provide the keys if secure boot is disabled. Sorry for the misunderstanding.