HP ThinPro’s TPM-sealed LUKS key falls to a tweak in the unencrypted boot partition, since PCRs miss initramfs and kernel.
4 comments
> only measured half the boot chain
That framing is too generous to HP, because the TPM did not “miss” initramfs and the kernel by accident, it was deliberately set up to trust an unmeasured, writable boot partition. Sealing a disk key to PCRs that stop at GRUB is not half a secure boot chain, it is just a policy that hands the attacker the key as soon as they can edit the next file on disk.
> only measured half the boot chain
Not quite, they measured the part that still lets you swap the rest on disk.
> they measured the part that still lets you swap the rest on disk.
Isn't that exactly the problem, though, because the thing that gets measured is the thing deciding whether to trust the mutable next stage, so if initramfs and the kernel can be changed on disk then the TPM policy is still handing over the key to attacker-controlled code?
> the tpm policy is only bound to pcrs 0, 2, and 4
that means it is only checking firmware and grub, not the code grub loads next. so the disk key is being released to a boot path that can be swapped out from the unencrypted side.
in practice, that turns the tpm into a gatekeeper for the loader, not for the whole boot chain. the crypto is intact, but the thing deciding whether to ask for the key is sitting in writable territory.