Close
0%
0%

No TPM? Your Hardware Is Already The Key

luks-hwid derives a LUKS unlock key from what your machine is made of: RAM serials, CPUID, board serial.

Similar projects worth following
0 followers
Every fleet has them: honest desktop towers, aging laptops, fanless industrial boxes. No TPM 2.0, or a dusty TPM 1.2 nobody can use. On those machines, full-disk encryption usually costs you one of two things: someone typing a passphrase at every boot, or a key file sitting in plaintext next to the data it protects. `luks-hwid` gives you a third option. The machine derives its own unlock key from what it is made of (RAM serials, CPU identity, mainboard serial, USB device serials), so it boots hands-free, while a disk that leaves the chassis has nothing to say to anyone.

Enjoy this project?

Share

Discussions

Alex wrote 08/20/2026 at 14:52 point

It's still unclear what you're trying to protect yourself from? What's the attack vector? What's the attack surface on your system?

It all seems like, "We can generate a unique key for each computer and that's enough."
But damn, that's not enough at all.

  Are you sure? yes | no

rmingon wrote 08/16/2026 at 20:15 point

Always better than a clear key in /boot or nothing

  Are you sure? yes | no

rmingon wrote 08/16/2026 at 20:15 point

It protects through obfuscation. Putting the key on a USB stick has no real benefit, first for reliability reasons, but also because deriving it from the hardware means each PC gets a different encryption key, and to understand the obfuscation you'd still have to decompile the binary.

  Are you sure? yes | no

Alex wrote 08/16/2026 at 20:04 point

It's completely unclear what this project protects against. If the computer is completely stolen, then all its unique identifiers will also end up in the hands of the thief. If anything, only the hard drive is stolen. So, a very simple solution is to store the disk encryption keys on a flash drive connected not directly to the motherboard, but through a simple extension cable. The flash drive itself is hidden in a tangle of USB cables.

What are you trying to protect and from whom?

  Are you sure? yes | no

Similar Projects

Does this project spark your interest?

Become a member to follow this project and never miss any updates