Every fleet has them: honest desktop towers, aging laptops, fanless industrial
boxes. No TPM 2.0, or a dusty TPM 1.2 nobody can use. On those machines,
full-disk encryption usually costs you one of two things: someone typing a
passphrase at every boot, or a key file sitting in plaintext next to the data
it protects. `luks-hwid` gives you a third option. The machine derives its
own unlock key from what it is made of (RAM serials, CPU identity, mainboard
serial, USB device serials), so it boots hands-free, while a disk that leaves
the chassis has nothing to say to anyone.
It protects through obfuscation. Putting the key on a USB stick has no real benefit, first for reliability reasons, but also because deriving it from the hardware means each PC gets a different encryption key, and to understand the obfuscation you'd still have to decompile the binary.
It's completely unclear what this project protects against. If the computer is completely stolen, then all its unique identifiers will also end up in the hands of the thief. If anything, only the hard drive is stolen. So, a very simple solution is to store the disk encryption keys on a flash drive connected not directly to the motherboard, but through a simple extension cable. The flash drive itself is hidden in a tangle of USB cables.
It's still unclear what you're trying to protect yourself from? What's the attack vector? What's the attack surface on your system?
It all seems like, "We can generate a unique key for each computer and that's enough."
But damn, that's not enough at all.