Encryption of rootfs A&B partitions unattended using TPM

petermilani80
Sun, 26 Mar 2023 10:46:42 +0000
General Discussions

Hi
I’m evaluating Mender for encryption and security of applications from theft and exploitation. I understand the that the current Mender Secure boot, will not protect against attackers mounting a removable hard drive and mounting either partition to read/copy information of it.

Therefore I would like to encrypt the rootfs and data partitions with a Key stored on a TPM device after SB. An example is The ultimate guide to Full Disk Encryption with TPM and Secure Boot (with hibernation support!)

I am wondering if this has been successfully implemented and what modifications to the quoted recipe would be needed to handle atomic updates and provisioning. (presumably some new measurement to be conducted and updating of TPM during the update process)

I’m sure someone has looked at this as I see some Yocto metas for encrypting a data partition and a couple of questions on this site. Any suggestions on how to proceed?

cheers
Peter

12 posts - 3 participants

Read full topic