How can I setup an encrypted home directory or encrypted disk using TPM?

Question

I'm running Ubuntu 14.04 on a Dell computer that has TPM.

1. I need to protect the files in the home directory in case the disk is removed from the computer and plugged into another computer, encryption will be a reasonable solution for this

2. I need for the current computer to not ask for a passphrase on boot (as it will be sort of a public computer).

To meet these two needs, I have discovered that TPM is exactly what I need and fortunately the computer has TPM. The encryption key can be stored in the secure TPM chip and it can be used to automatically decrypt the disk on boot. However, there is no clear instruction on how to achieve this. Can anyone help?

Answer 1

According to http://manpages.ubuntu.com/manpages/trusty/man4/tpm.4freebsd.html#contenttoc3

the Supported tpm modules are:

       ·   Atmel 97SC3203
       ·   Broadcom BCM0102
       ·   Infineon IFX SLD 9630 TT 1.1 and IFX SLB 9635 TT 1.2
       ·   Intel INTC0102
       ·   Sinosun SNS SSX35
       ·   STM ST19WP18
       ·   Winbond WEC WPCT200

If your chip is supported then a good starting point for tpm 1.2 would be

http://www.ranzbak.nl/tpmluks/

In any other case (Support for TPM 2.0 is still incomplete as far as i know) you could alternatively just use encrypted luks and store the password on a removable usb key that you could carry with you.