Secure Dual-Boot Setup with TPM2 and Whole-Disk Encryption for openSUSE and Windows 11

Introduction

This article outlines the steps to securely set up a dual-boot system with TPM2 (Trusted Platform Module version 2) and whole-disk encryption on an openSUSE and Windows 11 laptop. This setup is particularly useful for users who need to share data between the two operating systems while maintaining a high level of security.

Prerequisites

• A laptop with TPM2 support
• Two separate partitions for each operating system (Linux and Windows)
• OpenSUSE Leap 15.4 or later
• Windows 11

Setting up TPM2 on openSUSE

Before setting up whole-disk encryption, we need to ensure that TPM2 is properly configured in openSUSE.

Step 1: Check TPM2 Status

Open a terminal and type:

This command will display the TPM version if it is supported. If not, you may need to update your BIOS or purchase a TPM module.

Step 2: Enable TPM2

Open the YaST2 Configuration Center and navigate to 'Security and Users'. Click on 'TPM Administration' and then 'TPM Configuration'. Click 'Next' and 'Enable TPM'. Enter your root password and click 'Finish'.

Setting up whole-disk encryption on openSUSE

Now that TPM2 is configured, we can set up whole-disk encryption using LUKS (Linux Unified Key Setup).

Step 1: Create a new encryption key

Open a terminal and type:

Replace 'X' with the partition number for the Linux installation.

Step 2: Open the encrypted partition

Type:

Replace 'X' with the partition number for the Linux installation and '/path/to/keyfile' with the path to the encryption key file.

Step 3: Create a new file system

Type:

Step 4: Mount the new file system

Edit the '/etc/fstab' file and add the following line:

Setting up TPM2 on Windows 11

Next, we need to configure TPM2 on Windows 11.

Step 1: Enable the TPM

Press 'Win + X' and select 'Device Manager'. Expand the 'Security' section and right-click on 'Trusted Platform Module'. Click 'Enable device'.

Step 2: Configure the TPM

Press 'Win + R' and type 'tpm.msc'. Click 'Yes' when prompted. Right-click on 'TPM' and select 'Properties'. Click 'New' and then 'Create Owner Password'. Enter a strong password and click 'OK'.

Setting up whole-disk encryption on Windows 11

Now that TPM2 is configured on both operating systems, we can set up whole-disk encryption on Windows 11 using BitLocker.

Step 1: Enable BitLocker

Press 'Win + I' and select 'Settings'. Click 'Accounts' and then 'Sign-in options'. Click 'Change' under 'Windows password'. Click 'Add' and then 'Local account'. Enter a strong password and click 'Next'.

Step 2: Enable BitLocker for the Windows partition

Open a Command Prompt as an administrator and type:

Replace 'Password' with a strong password.

With this setup, both the Linux and Windows installations are protected by TPM2 and whole-disk encryption. Data can be securely shared between the two operating systems without compromising security. For more information, check out the following resources:

• openSUSE TPM documentation
• Microsoft TPM documentation
• Wikipedia TPM article