Arch Linux

Swiggles

Member

Registered: 2014-08-02

Posts: 266

[Solved] Regression in tpm2-tools

Hello everyone,

today I need some help from you guys and I hope someone can help me.

Recently I setup a tpm hook to unlock my luks encrypted lvm partition on my laptop. This was working perfectly fine in combination with the encrypt hook. But recently tpm2-tools got updated to 4.0 and it broke.
Easy enough, the release notes state that many parameters were removed and renamed. So I tried to substitute them according to the man page.

Previously:

tpm2_unseal -H 0x81000000 -L sha1:0,7

Now:

tpm2_unseal -c 0x81000000 -p pcr:sha1:0,7

This is working on the command line and I see the binary blob which roughly looks like my keyfile. To confirm I change the pcr value and I get an error as expected.
I updated my crypt-tpm hook with these changes and upon reboot it's just stuck. It loads all hooks until the crypt-tpm line appears and nothing happens until I reboot. Unfortunately there is no error output in any shape or form. Ofc no log files or journal, because the drive is still encrypted and nothing on the screen.

Here is my mkinitcpio.conf

MODULES=(tpm tpm_tis tpm_crb tpm_tis_core)
BINARIES=()
FILES=()
HOOKS=(base udev autodetect keyboard keymap consolefont modconf block encrypt-tpm encrypt lvm2 filesystems resume fsck)
COMPRESSION="cat"

/etc/initcpio/install/encrypt-tpm

#!/bin/bash

build() {
    local mod

    add_module "tpm_crb"

    add_binary "tpm2_unseal"
    add_binary "/usr/lib/libtss2-tcti-device.so"

    add_runscript
}

help() {
    cat <<HELPEOF
This hook allows for reading the encryption key from TPM.
HELPEOF
}

/etc/initcpio/hooks/encrypt-tpm

#!/usr/bin/ash

run_hook() {
    modprobe -a -q tpm_crb >/dev/null 2>&1
    tpm2_unseal -c 0x81000000 -p pcr:sha1:0,7 -o /crypto_keyfile.bin
    #tpm2_unseal -H 0x81000000 -L sha1:0,7 -o /crypto_keyfile.bin
}

For good measure here is my pacman.log. There you can see I downgraded tpm2-tools as a workaround.

I was planning to document everything in the wiki soon, but I held off until it proved to be stable. Now I am a bit stumped.

Last edited by Swiggles (2019-10-19 19:58:16)

Elektro

Member

From: Spain

Registered: 2009-05-28

Posts: 16

Re: [Solved] Regression in tpm2-tools

Hello.

I'm interesting on this topic since I didn't see any documentation in the wiki of how to install successfully TPM2.0 to unlock LUKS.

If you need some help about something specific just tell me. I don't have an specific knowledge but I can try to test something.

Regards.

Do

Member

Registered: 2019-10-19

Posts: 1

Re: [Solved] Regression in tpm2-tools

I have encountered almost the same problems except that it can be pushed forward by pressing keys randomly with the keyboard in my case.

Here is the solution by Pawit Pornkitprasan  that works for me: https://medium.com/@pawitp/tpm2-unseal- … 36012e214c which points out that it's due to lack of entropy.

BTW, @pawitp also has a nice article on how to set up Secure Boot / LUKS / TPM on Arch Linux: https://medium.com/@pawitp/full-disk-en … 892cab9704 .

Hope it help.

Last edited by Do (2019-10-19 08:38:17)

Swiggles

Member

Registered: 2014-08-02

Posts: 266

Re: [Solved] Regression in tpm2-tools

rng_core.default_quality=1000

Adding this to the commandline indeed fixes the problem.

You were on point, thank you very much! :-)