Hacker News new | ask | show | jobs
by jtchang 1790 days ago
Is there anything on the consumer level like this?
3 comments

Well, a lot of laptops these days have TPMs that can store disk encryption keys. BitLocker on Windows, or an exotic dm-crypt setup on Linux.

However for a server, the chance of a thief getting a disk and the HSM at the same time is low; and you really don't want to have to enter a password every boot. So the HSM design delivers some benefits worth having.

Whereas for a laptop, you can easily type in a password; and the chance of a thief snatching the disk and TPM at the same time is basically 100%. So there hasn't been a big push among Linux users to start using the TPM.

It was all made out of parts with standardized interfaces, so components could be consumer equipment.

I also used the same software on my laptop to encrypt it. It's nothing fancy, just using the dm-crypt kernel module and any kind of hardware security module that talks PKCS#11 (which is all of them); On my laptop I just used my existing smartcard (which I used to login to the system and remote systems).

The disk header was just text occupying the first 4MiB of the disk in 2 circular buffers similar to LVM (though 2 copies for redundancy).

Purism will sell you a setup with the Librem laptop and hardware key, which has some verification of the system firmware as well as, presumably, supporting disk decryption. I'm not sure how much extra that gives you over fairly generic hardware tokens with LUKS encryption. Apparently LUKS2 supports FIDO2 keys, which may be the cheapest.