mortar VS swtpm

Bruteforce of such random password is just not plausible and talks about KDF "weakness" is just a distraction. I think most likely it was evil maid attack.

Here are projects which try to mitigate some of evil maid attack risks:

https://github.com/noahbliss/mortar

https://safeboot.dev/

Secure boot and TPM support (à la Mortar: https://github.com/noahbliss/mortar)

There are tools that look to be able to automate it: https://github.com/noahbliss/mortar/blob/master/docs/proxmox-install.md

I just went through the process of setting up new ubuntu VM's using full root disk LUKS encryption and auto-unlock via Proxmox's vTPM2.0 and UEFI ( via this extremely helpful resource https://github.com/noahbliss/mortar )

I have used this project with Debian+proxmox and it's been working great. https://github.com/noahbliss/mortar but I did read the arch wiki a bit which helped my understanding.

There's a project called "mortar" (as in, gluing all these bricks together) that was attempting to simplify this. Though it's lost steam, reading through it's simple bash scripts was a great place to start for me. This guide for Fedora also helped a lot.

There have been a number of attempts to solve this problem, but the most complete appear to be Mortar (a project I head) and safeboot.dev

I highly recommend taking a look at either of these projects if you want be able to improve both your convenience through auto unlocking, and security through broadened scope of audit.

https://github.com/noahbliss/mortar

https://safeboot.dev

Check out mortar. It uses secure boot and TPM along with LUKS. The creator is super helpful and available on the telegram.

A more advanced approach would be something like mortar to chain-load signed stuff.

There seems to be a workable solution out there for 2.0: https://github.com/noahbliss/mortar/blob/master/docs/proxmox-install.md

Or you can just add a virtual tpm device in virt-manager while setting up the vm using swtpm. It seems to ha e packages on most major distro's.

If you want Windows 11 instead for whatever reason, swtpm can emulate a TPM chip for QEMU to use.

You can find the source of software TPM implementations which abide to the official spec such as: https://github.com/stefanberger/swtpm but that has no real bearings on the TPM used on real hardware

I install swtpm and in virt-manager add a TPM 2.0 emulated device and set the secure boot image before I install. This seems to work well enough.

I don't know either, but apparently Microsoft didn't guarantee that 'unsupported' systems would continue to receive system updates. I just use a QEMU VM and swtpm.

swtpm - a software Trusted Platform Module emulator and the ways of using it;

Seems there are two such projects for that:

https://github.com/stefanberger/swtpm

This should work: https://github.com/stefanberger/swtpm/wiki

Linux has several TPM emulators. This one is probably the most popular. But here's another for TPM 1.2 only. The main use-case is to emulate TPMs for use with Virtual Machine guests.

Other GitHub posts from previous versions seem to have the issue described here but maybe I missed something, https://github.com/stefanberger/swtpm/issues/572 I'm on an arch install and just installed it from pacman.