From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <glkdd-dm-crypt@m.gmane.org>
Received: from plane.gmane.org (plane.gmane.org [80.91.229.3])
 (using TLSv1 with cipher AES256-SHA (256/256 bits))
 (No client certificate requested)
 by mail.server123.net (Postfix) with ESMTPS
 for <dm-crypt@saout.de>; Sat, 18 Oct 2014 01:50:03 +0200 (CEST)
Received: from list by plane.gmane.org with local (Exim 4.69)
 (envelope-from <glkdd-dm-crypt@m.gmane.org>) id 1XfHHX-0003sD-8n
 for dm-crypt@saout.de; Sat, 18 Oct 2014 01:50:03 +0200
Received: from 66.87.138.247 ([66.87.138.247])
 by main.gmane.org with esmtp (Gmexim 0.1 (Debian))
 id 1AlnuQ-0007hv-00
 for <dm-crypt@saout.de>; Sat, 18 Oct 2014 01:50:03 +0200
Received: from eternaleye by 66.87.138.247 with local (Gmexim 0.1 (Debian))
 id 1AlnuQ-0007hv-00
 for <dm-crypt@saout.de>; Sat, 18 Oct 2014 01:50:03 +0200
From: Alex Elsayed <eternaleye@gmail.com>
Date: Fri, 17 Oct 2014 16:51:52 -0700
Message-ID: <m1s9uc$3q9$2@ger.gmane.org>
References: <CAHeB2AnBcV3RnFc7JJ+xX7fj5NspWNBfP5-eVP4xAoUmHUUgMA@mail.gmail.com>
 <543D92A8.50701@freesources.org> <20141014215108.GA14529@tansi.org>
 <CAHeB2AnC4h16rxvtXgTuwbFW0dcf+t+HqLs3yzT+x8M8kh7h=g@mail.gmail.com>
 <m1s9m3$3q9$1@ger.gmane.org>
Mime-Version: 1.0
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: 7Bit
Subject: Re: [dm-crypt] LUKS disk encryption with remote boot authentication
List-Id: <dm-crypt.saout.de>
List-Unsubscribe: <http://www.saout.de/mailman/options/dm-crypt>,
 <mailto:dm-crypt-request@saout.de?subject=unsubscribe>
List-Archive: <http://www.saout.de/pipermail/dm-crypt/>
List-Post: <mailto:dm-crypt@saout.de>
List-Help: <mailto:dm-crypt-request@saout.de?subject=help>
List-Subscribe: <http://www.saout.de/mailman/listinfo/dm-crypt>,
 <mailto:dm-crypt-request@saout.de?subject=subscribe>
To: dm-crypt@saout.de

Alex Elsayed wrote:

> Well, it actually _is_ entirely possible:
> 
> If your machine has a TPM (yes, big 'if', but many laptops do although
> embedded boards don't), then tpm-luks[1] uses the TPM to store the
> cryptsetup key in the TPM's nvram, such that it can only be extracted if
> everything is unmodified.

Gah, forgot my footnote.

[1] https://github.com/shpedoikal/tpm-luks

<snip>