I have setup my fedora to use LUKS encryoted partitions. But entering two passwords gets quite tiring, as I shutdown my laptop quite often to get the benefit of LUKS (I am assuming nothing is encrypted when in suspend, please correctme if I am wrong)

I am thinking about setting up TPM autodecrypt. However, I was wondering does the decryption happen on boot or after I login?

If it happens on boot, then it seems like the benefit is pretty limited compare to a unencrypted drive. Since the attacker can simply boot my laptop and get the unecrypted drive.

Am I missing something here? I was wondering is there a way for me to enter my password once and unlock everything, from disk to gnome keyring?

  • baseless_discourse@mander.xyz
    ·
    11 months ago

    I was wondering what security does the TPM password provides. If I understand correctly, it will prevent attacker from getting the data on the disk.

    However, theoretically, attacker can boot the laptop and disconnect the disk to get a decrypted disk. Realistically, I think my laptop will shutdown when the chasis is opened (unless configured otherwise in the bios). So it should be safe?