Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to use the TPM to secure my boot process for my linux laptop. Any manual, howto or tutorial I have found about this topic mentions I have to use the TrustedGrub bootloader to keep up the trust chain. TrustedGrub, however, is not in the repositories of any major distribution, it is based on Grub1 so the number of file systems it can boot from is quite limited, and worst of all, it cannot boot from UEFI, so I simply cannot use it.

What I want to do is seal a passkey for unlocking an encrypted drive in the TPM.

The question on my mind is: do I really absolutely have to use TrustedGrub to use the TPM, or can I use another boot loader like Grub2, Shim, Gummiboot or whatelse is there? Does the bootloader actually matter which bootloader I choose?

share|improve this question

It depends on your requirements. You can always access the TPM and perform sealing/unsealing operations.

But if you want a secure boot then you have only two options:

  • Use a bootloader which is extending the chain of trust.
  • Perform a late launch, for example with Intel's tboot and Intel TXT.

If you don't do either, you can't trust your platform configuration.

EDIT: On January 30th 2014, TBoot announced support for UEFI.

share|improve this answer
Neither TrustedGrub nor tboot work on UEFI systems, so any advice on a bootloader extending the chain of trust? – Peter Jul 15 '13 at 21:47
None that I know of - sorry. Maybe you shoul look into UEFI's secure boot stuff... – Scolytus Jul 16 '13 at 19:17
I would if I could, but sadly, no secure boot support on that system, just plain UEFI. – Peter Jul 17 '13 at 8:50
Well, if you don't need any special UEFI functions you could try to use legacy/BIOS mode. But I haven't tried it nor do I know how the chain of trust would be built in this setup. – Scolytus Jul 19 '13 at 5:53

In case of both, secure booting and trusted booting you need to get trusted grub. Trusted grub will measure the boot process. I am not aware of anything which is not using trusted grub.

share|improve this answer

You do not need to install or configure TrustedGRUB to use the TPM tools in Linux.

I experimented with the tools on my system and they worked without TrustedGRUB being installed, including sealing and unsealing files. You'd probably seal a file containing the key and then hook into an existing bootscript (or add a bootscript) to unseal the key and use it to run a cryptsetup luksOpen ... --key-file {your unsealed key on a tmpfs} or similar.

Of course, take ownership of the TPM and reboot first.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.