Hacker News new | past | comments | ask | show | jobs | submit login

If you've got a TPM to leverage, this is essentially actually what systemd-cryptenroll --tpm2* does. Generate a large, cryptographically-secure key and pair it with PBKDF2 with 1000 iterations. Seal that random value in the TPM with optional PIN.

If used, the PIN itself can just be your prior disk encryption passphrase, and now you have the same PW entropy as before with additional protection against PCR modifications and brute-forcing via the TPM




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: