Hacker News new | ask | show | jobs
by mo2art 1976 days ago
How is this superior to clevis? https://blog.dowhile0.org/2017/10/18/automatic-luks-volumes-... https://m.youtube.com/watch?v=Dk6ZuydQt9I
2 comments

It enables you to use a token that is portable and removable, which TPM2 chips are not. This has an advantage that it can be carried and secured separately, even if the device has to go into insecure storage like a hotel safe. You need to trust your FIDO2/PKCS11 device to be secure, though.

Clevis, on the other hand, allows to bind the key to a specific machine, preventing the storage itself from being yanked out (where it is still possible) - and you need to trust TPM2, which many do not.

It's all about trade-offs and trust.

Superior might be a stretch, but it the ability to use PKCS11 and FIDO2 tokens look to be differentiating features.