{"id":121385,"date":"2025-01-17T15:46:00","date_gmt":"2025-01-17T13:46:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obhod-diskovogo-shifrovaniya-ispolzuyushhego-tpm2-dlya-avtomaticheskoj-razblokirovki"},"modified":"2025-01-17T15:46:00","modified_gmt":"2025-01-17T13:46:00","slug":"obhod-diskovogo-shifrovaniya-ispolzuyushhego-tpm2-dlya-avtomaticheskoj-razblokirovki","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/obhod-diskovogo-shifrovaniya-ispolzuyushhego-tpm2-dlya-avtomaticheskoj-razblokirovki","title":{"rendered":"Bypassing disk encryption using TPM2 for automatic unlocking","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
One of the packages accompanying NixOS presented an attack technique that allows access to data on encrypted disk partitions in configurations that do not require a password for unlock during boot, by placing the decryption information in the TPM2 (Trusted Platform Module). Such configurations are often used on servers or multi-user workstations, where it is problematic to manually enter the password after each reboot. <\/p>\n
When using such disk encryption methods, decryption is performed using an additional key stored in the TPM, which is issued only upon confirming the system's original state. The system's state is preserved as hashes in the PCR (Platform Configuration Register) registers and is tied to the digital signature that the bootloader is signed with, as well as to the checksums of the bootloader and the initial boot environment (initrd). Access to the key in the TPM is granted only when all associated PCR registers are in the same state as when the key was saved. <\/p>\n
It is implied that the operating system boot chain is verified using UEFI Secure Boot and that access to the keys can only be obtained from an unmodified initrd image. Upon successful verification, the disk is automatically unlocked, but access to the decrypted data can only be achieved by logging into your account in the system. If there is an attempt to access without verified boot or to replace or modify the initrd to intercept the keys, the chain of trust will be broken, the state of the PCR registers will change, and the TPM2 will not provide the information needed for decryption. <\/p>\n
The published attack method allows bypassing the need to alter initrd contents in configurations that do not identify LUKS encrypted partitions. It is noted that enabling such partition checks is not described in all found disk encryption setup instructions, as identifying the partition significantly complicates the configuration (it requires engaging an additional PCR register to verify the partition key and generating initrd considering its value). Examples of the attack are demonstrated for Fedora Linux using the clevis toolkit and for NixOS using systemd-cryptenroll. Physical access to the computer and the ability to extract the storage device are necessary to carry out the attack. <\/p>\n
The method is based on the attacker being able to replace the existing root encrypted partition with their own encrypted partition, created with the same UUID identifier and known decryption keys. The initrd environment will hand control to the init process in the attacker's partition. Since the contents of initrd have not been altered, the state of the TPM will not be violated, and upon gaining control in their environment, the attacker can use the TPM to decrypt the key of the original disk partition. <\/p>\n
The attack boils down to the following steps: <\/p>\n
\n
Extracting the disk and analyzing the unencrypted data in the \/boot partition on another computer. Identifying information about the encrypted partition and its UUID identifier from the initrd image located in the \/boot partition.\n
Creating a backup of the first 64MB of the LUKS encrypted partition.\n
Replacing the specified 64MB with an image containing their own root partition, encrypted using a known key and having the same UUID identifier as the old partition.\n
Returning the disk to the original computer and booting with the substituted root partition. Since the automatic unlocking via the key from the TPM for the substituted partition fails, initrd prompts for manual password entry.\n
Retrieving the original key from the TPM, using metadata about the TPM and the encrypted token from the LUKS header of the old partition.\n
Reinstalling the disk on the attacker's computer, restoring the overwritten part of the LUKS partition from the backup, and using the retrieved original key to access the data. <\/ul>\n