Hardware-backed disk encryption requirements¶
Ubuntu checks certain system requirements before it allows you to enable hardware-backed disk encryption (TPM/FDE) on your system. Generally, most systems based on Intel and AMD processors made since 2018 are compatible with TPM/FDE. On most systems made since 2021, the disk can unlock automatically by default.
Warning
Hardware-backed disk encryption is currently a Beta feature. See the current limitations and known issues.
Your hardware must meet the following requirements to support TPM/FDE:
Your device comes with the Unified Extensible Firmware Interface (UEFI) version 2.5 or later with the following features:
It meets the Platform Configuration Register (PCR) usage and log requirements of the Trusted Computing Group (TCG) EFI PC Client Platform Profile specification (2.0 family).
It implements the TCG EFI Protocol spec (2.0 family). Some older UEFI implementations only support 1.2 family versions of the TCG specifications, which is insufficient for TPM/FDE.
Your device has a PC-client Trusted Platform Module version 2 (TPM2) chip, version 1.32 of the reference library specification or later.
Secure Boot is enabled and in Deployed Mode.
Automatic unlocking¶
Your disk can unlock automatically without a PIN or passphrase if the UEFI firmware is verified or measured by a hardware root of trust. This is generally the case for PCs made since 2021. Automatic unlocking is also known as TPM-only unlock.
To verify or measure the firmware, your device must feature a dedicated security chip:
The Boot Guard Authenticated Code Module (ACM) on Intel systems.
Platform Secure Boot (PSB) enabled on AMD systems.
Note
Certain hardware vendors might enable firmware options that alter your system’s chain of trust, such as the Absolute Persistence technology.
The Ubuntu installer alerts you to this. You can choose to disable the feature if you have the permissions or you can ignore the notice to keep the feature enabled.
With a hardware root of trust, your hardware verifies the UEFI firmware before the firmware runs, based on a read-only piece of code in your CPU. This protects your disk encryption against threats such as malware that targets your firmware, or supply-chain attacks while your hardware is handled after manufacture.
If your system does not have a hardware root of trust, the Ubuntu installer makes it mandatory to add a PIN or passphrase. After installation, you can disable the PIN or passphrase. However, your system won’t be protected against the described hardware and firmware threats.
Report bugs¶
If you think that your system should be eligible for TPM/FDE given these requirements, but Ubuntu still doesn’t enable TPM/FDE, open a bug.