RHEL6 LUKS with TPM support?

Question

I'm surprised that this question is not asked more frequently, but (in RHEL) does LUKS support TPM's the way that Windows BitLocker does? If so, how is this feature implemented, and does it provide the same type of protections that BitLocker for Windows provides?

BitLocker is very popular among businesses, and now that RHEL6 is getting FIPS certification for the disk encryption modules, it would be great if it also supported the same feature set.

However, I do understand that with the way LUKS works, not every volume can be encrypted, since the system would need to read the /etc/fstab and the /etc/crypttab files in order to mount the volumes. I believe this is OK as long as /home, /var, and other directories chosen by the administrator are encrypted.

I find it odd that "TPM" is not a tag on serverfault.

Answer 1

I've implemented support for storing your LUKS key in TPM NVRAM, and RHEL6 happens to be the one platform where all features are fully tested, see this post:

[1] http://security.stackexchange.com/a/24660/16522

Answer 2

This isn't supported out the box, but you probably can hack something together. The idea is to seal the LUKS key in the TPM, and then set up a trusted boot path which unlocks the sealed key. You'll need to install TrustedGRUB, and write a keyscript for /etc/crypttab which retrieves the key from the TPM. This will all happen in the initrd, so that will probably need to include the TPM tools. This post has a good description of the basic TPM installation.