HackerTrans
TopNewTrendsCommentsPastAskShowJobs

oddlama

no profile record

Submissions

Bypassing disk encryption on systems with automatic TPM2 unlock

oddlama.org
1 points·by oddlama·w zeszłym roku·0 comments

comments

oddlama
·w zeszłym roku·discuss
I've written something like this for NixOS a while back [1], which generates infrastructure diagrams directly from the source of truth (albeit not as pretty as isoflow). I'm sure this could be applied to other declarative tech stacks aswell!

[1]: https://github.com/oddlama/nix-topology
oddlama
·w zeszłym roku·discuss
This is great if you only have a single disk, but if you have multiple encrypted disks that are unlocked in the initrd this way, then if you can gain control flow by faking data on the last decrypted disk you can still gain access to all the previously unlocked partitions.

Of course you cannot unseal the secret from the TPM anymore.
oddlama
·3 lata temu·discuss
I can think of plenty real world usecases. Take for example a network interface that can send or receive predefined packet structs.

Imagine each packet requires a size header. When you want to send multiple packets at once, you now want to optimize that and only write a single initial header to the interface, preceding the data.

With variadic generics, you can enable a syntax like `interface.write_packets(packet1, packet2, packet3, /* ... */);` which writes the packets in the desired optimized way. It can internally construct a serializable data tuple from the variadic generics and add the correct header only to the beginning.

Without variadic generics a similar syntax is only possible with macros, which means that it cannot be implemented as a reusable trait.

> It would seem to me, you're just skipping the part where you give your tuple a name, but is that even a good idea to do?

Sometimes you explicitly don't want to require naming the tuple for flexibility, like in the example above.
oddlama
·3 lata temu·discuss
And additionally I would't want anyone on my network path to be able to read what data I exchange - even if it is a static site.