JustEnoughDucks , 4 months ago

But what is the threat model where a TPM-stored LUKS key protects against?

I fail to see it. It doesn’t protect against any physical attacks at all, and it also doesn’t protect against attacks while the system is powered on.

It seems to only protect against the attack of someone stealing your hard drive out of your system but leaving the entire system behind. Maybe for encrypting extra data drives that will want to be resold later? But that is more a datacenter threat model