Lennart: Linux Comes Up Short Around Disk Encryption, Authenticated Boot Security

guest · Sep 23, 2021

Lennart: Linux Comes Up Short Around Disk Encryption, Authenticated Boot Security
September 23, 2021
https://www.phoronix.com/scan.php?page=news_item&px=Linux-FDE-Auth-Boot-Lacking

Most Linux distributions are currently coming up short from offering adequate security around full disk encryption and authenticated boot.

Lead systemd developer Lennart Poettering wrote a lengthy blog post today around the state of authenticated boot and disk encryption on Linux. While many Linux distributions offer full-disk encryption, offer UEFI SecureBoot, and begun embracing TPMs, many of the technologies aren't being used to their best potential yet especially now by default / out-of-the-box.
Click to expand...

Lennart's short summary of the situation is:

Linux has been supporting Full Disk Encryption (FDE) and technologies such as UEFI SecureBoot and TPMs for a long time. However, the way they are set up by most distributions is not as secure as they should be, and in some ways quite frankly weird. In fact, right now, your data is probably more secure if stored on current ChromeOS, Android, Windows or MacOS devices, than it is on typical Linux distributions.
Click to expand...

In his blog post he outlines the current technologies, the issues at hand, and areas for improvement in improving authentication and providing better security.
Click to expand...

The Strange State of Authenticated Boot and Disk Encryption on Generic Linux Distributions

Generic Linux distributions (i.e. Debian, Fedora, Ubuntu, …) adopted Full Disk Encryption (FDE) more than 15 years ago, with the LUKS/cryptsetup infrastructure. It was a big step forward to a more secure environment. Almost ten years ago the big distributions started adding UEFI SecureBoot to their boot process. Support for Trusted Platform Modules (TPMs) has been added to the distributions a long time ago as well — but even though many PCs/laptops these days have TPM chips on-board it's generally not used in the default setup of generic Linux distributions.

How these technologies currently fit together on generic Linux distributions doesn't really make too much sense to me — and falls short of what they could actually deliver. In this story I'd like to have a closer look at why I think that, and what I propose to do about it.
Click to expand...

Log in or Sign up

Lennart: Linux Comes Up Short Around Disk Encryption, Authenticated Boot Security

guest Guest

Log in or Sign up

Lennart: Linux Comes Up Short Around Disk Encryption, Authenticated Boot Security

guest Guest

Useful Searches