TPM 2.0 Support for Additional Security

[Fenris]

@BluishHumility

You do not store TPM keys in KeePassXC, nor anywhere else. They are intended to be impossible to extract from the TPM chip. If you want to use KeePassXC to unlock your encrypted drive then use a complex passphrase instead.

Honestly, if additional security is your goal then a complex passphrase is the way to go anyway. Unlocking with TPM is basically the least secure possible unlock method; it only protects against a few very specific types of attacks.

I get what you are saying….

What Ubuntu was offering was a passphrase was used to unlock the drive + the use of TPM together. So you still get having to put in a huge password and you have to use it with TPM complamenting that password.

Now, if you remove that drive and try to do things to it, it goes haywire on you when you put it back into the computer with that TPM module. Then you have to put in this huge key like Windows 11 asks you to do to decrypt the drive, but instead of Windows doing that, Ubuntu does that instead. This is why they give you a QR code at install that you are expected to write down somewhere to unlock the drive.

@BluishHumility

Systemd is already installed. This feature is available since systemd 248. There is nothing difficult about it. You run two commands in the terminal and you are done.

After looking through the link provided, I don’t know how you plug both LUKs key + TPM in the setup. From what it looks like its either Passphrase OR TPM not Passphrase AND TPM