Windows 11 TPM dual démarrage
Windows 11 TPM dual démarrage
Does the fact that Windows 11 requires TPM and Secure Boot mean that we can no longer have a dual boot setup avec let say Linux par exemple?
Re: Windows 11 TPM dual démarrage
The **TPM** is a passive component; it ne get involved dans le boot processus on its own, unless an OS (or a bootloader) specifically tries to interact avec it. Vous pouvez dual-boot an OS even si cela ne have any support for the TPM.
That said, si vous *want* to use use the TPM from Linux, vous pouvez encore do so even si cela was initialized by Windows.
Windows initializes the TPM2 using a random "owner mot de passe" that it throws away... but the fact that it immediately throws away the mot de passe just tells you that vous n'avez pas need it for normal operation.
Par exemple, the RSA "storage root clé" is initialized in a standard way at 0x81000001 and can be used from any OS, including Linux. (Some tools, such as systemd-cryptenroll, will just ignore it and generate an ECDSA root clé à la place.)
(If necessary, vous pouvez encore convince Windows to store the owner mot de passe dans le Registry, although obviously you ne peut pas recover the one that was thrown away, so this requires re-initializing the TPM.)
Actuellement the seulement limitation is that you cannot use the high-level FAPI tools in Linux tpm2-tss, but that is really not a big loss; almost tout builds sur le "raw" EAPI anyway.
En revanche, the **Secure Boot** fonctionnalité can cause some trouble. Vous devriez encore be able to use Linux distributions like Fedora or Ubuntu which have official support for it (they have Microsoft-signed bootloaders).
Avec some tinkering, vous devriez be able to use the Microsoft-signed `Shim` to boot just about anything that supports UEFI. (C'est kind of a loophole, as Shim just prompts you to authorize unknown .efi fichiers by their hash.)
Secure Boot on x86 systems également allows you to set up *your own* signing clés alongside the Microsoft clés. This can get *quite* complicated, but nevertheless completely possible to have a Linux kernel or another .efi fichier be fully validated by your firmware's Secure Boot.
That said, si vous *want* to use use the TPM from Linux, vous pouvez encore do so even si cela was initialized by Windows.
Windows initializes the TPM2 using a random "owner mot de passe" that it throws away... but the fact that it immediately throws away the mot de passe just tells you that vous n'avez pas need it for normal operation.
Par exemple, the RSA "storage root clé" is initialized in a standard way at 0x81000001 and can be used from any OS, including Linux. (Some tools, such as systemd-cryptenroll, will just ignore it and generate an ECDSA root clé à la place.)
(If necessary, vous pouvez encore convince Windows to store the owner mot de passe dans le Registry, although obviously you ne peut pas recover the one that was thrown away, so this requires re-initializing the TPM.)
Actuellement the seulement limitation is that you cannot use the high-level FAPI tools in Linux tpm2-tss, but that is really not a big loss; almost tout builds sur le "raw" EAPI anyway.
En revanche, the **Secure Boot** fonctionnalité can cause some trouble. Vous devriez encore be able to use Linux distributions like Fedora or Ubuntu which have official support for it (they have Microsoft-signed bootloaders).
Avec some tinkering, vous devriez be able to use the Microsoft-signed `Shim` to boot just about anything that supports UEFI. (C'est kind of a loophole, as Shim just prompts you to authorize unknown .efi fichiers by their hash.)
Secure Boot on x86 systems également allows you to set up *your own* signing clés alongside the Microsoft clés. This can get *quite* complicated, but nevertheless completely possible to have a Linux kernel or another .efi fichier be fully validated by your firmware's Secure Boot.