mortar
tpm2-totp
mortar | tpm2-totp | |
---|---|---|
17 | 5 | |
208 | 149 | |
- | 7.4% | |
5.9 | 0.0 | |
5 months ago | about 1 month ago | |
Shell | C | |
GNU General Public License v3.0 only | BSD 3-clause "New" or "Revised" License |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
mortar
-
WTF is a KDF? A startling revelation from a French prison
Bruteforce of such random password is just not plausible and talks about KDF "weakness" is just a distraction. I think most likely it was evil maid attack.
Here are projects which try to mitigate some of evil maid attack risks:
https://github.com/noahbliss/mortar
https://safeboot.dev/
-
Installation with full-disk, two-factor encryption, secure boot, and TPM
Secure boot and TPM support (à la Mortar: https://github.com/noahbliss/mortar)
-
Complying with the future: Secure Boot and TPM unclocking
There are tools that look to be able to automate it: https://github.com/noahbliss/mortar/blob/master/docs/proxmox-install.md
-
Prevent backup of vTPM2.0 state?
I just went through the process of setting up new ubuntu VM's using full root disk LUKS encryption and auto-unlock via Proxmox's vTPM2.0 and UEFI ( via this extremely helpful resource https://github.com/noahbliss/mortar )
-
tpm2 + luks + ubuntu 18 setup?
I have used this project with Debian+proxmox and it's been working great. https://github.com/noahbliss/mortar but I did read the arch wiki a bit which helped my understanding.
-
What do you don't like about Linux? What is Windows doing better?
There's a project called "mortar" (as in, gluing all these bricks together) that was attempting to simplify this. Though it's lost steam, reading through it's simple bash scripts was a great place to start for me. This guide for Fedora also helped a lot.
-
Authenticated Boot and Disk Encryption on Linux
There have been a number of attempts to solve this problem, but the most complete appear to be Mortar (a project I head) and safeboot.dev
I highly recommend taking a look at either of these projects if you want be able to improve both your convenience through auto unlocking, and security through broadened scope of audit.
https://github.com/noahbliss/mortar
https://safeboot.dev
-
Best Evil Maid prototcol for Linux?
Check out mortar. It uses secure boot and TPM along with LUKS. The creator is super helpful and available on the telegram.
-
Mount encrypted volume at boot?
A more advanced approach would be something like mortar to chain-load signed stuff.
-
Will Proxmox be able to run Windows 11?
There seems to be a workable solution out there for 2.0: https://github.com/noahbliss/mortar/blob/master/docs/proxmox-install.md
tpm2-totp
-
TOTP tokens on my wrist with the smartest dumb watch
You need a TPM 2.0 compatible CPU, but something like this sounds really excellent: https://github.com/tpm2-software/tpm2-totp
This means your laptop itself would be your hardware device, the TOTP secret would be stored in the TPM and theoretically impossible to steal/copy. Of course this means you will probably want a mobile device (possibly a second laptop also) as a backup.)
- Can you detect tampering in /boot without SecureBoot on Linux?
-
Authenticated Boot and Disk Encryption on Linux
>But okay, you may extend my attack by saying that you exchange the motherboard between the victim and the attacker laptop, so that you don't need to replicate the chassis.
Modern computers has tamper detection and if you open them you'll need to type the BIOS password.
However, replacing the motherboard is going to replace the TPM. This is easily detectable with something like tpm2_totp in the bootchain.
https://github.com/tpm2-software/tpm2-totp
- Attest computer secure boot state to phone via time-based OTP and TPM
-
Does the TPM boost secure boot security?
You could also use TOTP for a kind of remote attestation (e.g., with your phone computing TOTP). In this setup, the CPU sends the timestamp to the TPM, and it returns the TOTP value. So instead of you looking at your phone to give the TOTP to a service provider to prove that you're in possession of your phone, the computer gives you a TOTP value to prove that it's in possession (inside the TPM, sealed to the boot chain hashes) of the TOTP secret, and you use your phone to verify this. A possible weakness (short of a full-blown TPM compromise) would be to send a bunch of forged timestamps to the TPM while your computer is running and store the resulting TOTP values, then tamper with Secure Boot and emit the precomputed TOTP corresponding to the current timestamp whenever you boot up your computer. But this would require running malicious code on your compute while you're logged in with the trusted boot chain.
What are some alternatives?
sbctl - :computer: :lock: :key: Secure Boot key manager
swtpm - Libtpms-based TPM emulator with socket, character device, and Linux CUSE interface.
btrfs-todo - An issues only repo to organize our TODO items
clevis - Automated Encryption Framework
heads - A minimal Linux that runs as a coreboot or LinuxBoot ROM payload to provide a secure, flexible boot environment for laptops, workstations and servers.
linux-secureboot-kit - Tool for complete hardening of Linux boot chain with UEFI Secure Boot
cryptboot - Encrypted boot partition manager with UEFI Secure Boot support
solo1 - Solo 1 firmware in C
decrypt-otpauth-files - Decrypt files created by OTP Auth
qubes-antievilmaid - Qubes component: antievilmaid
BangleApps - Bangle.js App Loader (and Apps)