Without a TPM you will be limited as to what you can do with any TCG
Opal compliant self encrypting drives (SED), and for a laptop this is a
very interesting feature to loose. Most all SSD's I know are Opal
compliant and many laptop spinning drives are as well. Take a look at
the rpm package sedutil to see the tool description, which under Qubes
would for now only work in Dom0 due to no TPM's, nor Virtual TPMs
(vTPM), being available to the user VM's domains. Just be aware that
sedutil has a steep learning curve, but it is worth it once you get your
brain wrapped around how it works.
I have done many interesting things with these drives that you might not
even think are possible, but with Qubes the best feature I could
envision is having a read-only boot partition where the system
configuration is first measured by the tamper-proof read-only protected
bootstrap kernel via the hardware TPM before the invisible Qubes-OS
partition is even mounted and launched. An AEM on steroids, because you
can not even physically write to the drive, and you can't even inspect
the actual encrypted OS that will boot if everything is
cryptographically matched. I'm working on a similar bootstrap project
configuration in my spare time which one day I would hope to extend to
my Qubes desktop.
Once Xen is launched it should be possible to launch virtual TPM's for
the user domains so that kernel or application keys can be securely
managed to create VLAN's, sign documents, etc. Having a vTPM might even
allow sedutil to be used for storing and locking data or even for
running user VM's (e.g. Offline storage for Tor Network VM's) on Opal
SSD drives, if the commands can pass-through the virtual sata emulation.
I don't know if that will work or not. If it does there are many, many
cool uses to try if I ever have the time to play with that technology
with Qubes. The problem being I only have my one desktop and can't
afford to pull the rug out from under myself here at work where I don't
have the tasking to play with this at the moment.
Anybody out there have any success installing Virtual TPM's under Xen?
If so please ping me offline.
Steve
On 03/28/2017 02:40 AM, Vít Šesták wrote:
AFAIU, TPM is useful mostly for AEM. But AEM requires Intel TXT (which is
missing even on some high-end CPUs). But TXT has various vulnerabilities. How
much real protection can it offer? Is it worth the hassle (finding a laptop
with both TPM and TXT and installing and using AEM)?
To be honest, I don't know much about TPM/AEM/TXT.
Regards,
Vít Šesták 'v6ak'
--
You received this message because you are subscribed to the Google Groups
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/qubes-users/fdee9a29-03c2-0ee8-6500-8f578329fca2%40jhuapl.edu.
For more options, visit https://groups.google.com/d/optout.
