Full-disk encryption via LUKS (Linux Unified Key Setup) ensures that storage media cannot be read if a laptop is lost or a drive is decommissioned. However, entering a long passphrase on every single system boot or reboot can be cumbersome, particularly for remote workstations or headless edge nodes. systemd-cryptenroll provides a modern, standardised mechanism built directly into systemd to enrol hardware security tokens—such as discrete TPM 2.0 (Trusted Platform Module) chips and FIDO2/WebAuthn security keys—into LUKS2 key slots for seamless, cryptographic hardware unlocking.
Prerequisites and Verifying LUKS2 and TPM 2.0 Support
Before enrolling hardware keys, confirm that your target encrypted storage volume utilizes the modern LUKS2 header format, as legacy LUKS1 lacks the metadata slots required by systemd:
sudo cryptsetup status dm_crypt-0
sudo cryptsetup luksDump /dev/nvme0n1p3 | grep VersionIf the version reports 1, convert the header to LUKS2 using sudo cryptsetup convert /dev/nvme0n1p3 --type luks2 after ensuring full backups.
Next, confirm that the Linux kernel detects your motherboard’s TPM 2.0 device and that the systemd TPM libraries are installed:
systemd-analyze has-tpm2
ls -l /dev/tpmrm0If systemd-analyze has-tpm2 returns yes, your platform firmware is ready to seal encryption keys against platform configuration registers (PCRs).
Enrolling TPM 2.0 for Automated Boot Decryption
To bind LUKS2 disk unlocking to your TPM 2.0 chip, execute systemd-cryptenroll with the --tpm2-device flag. Standard security practice binds unlocking to PCR 7 (Secure Boot state) or PCRs 0+2+7 (firmware code integrity and Secure Boot):
sudo systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+2+7 /dev/nvme0n1p3During execution:
- You are prompted to enter an existing, valid LUKS passphrase to authorise adding the new cryptographic token.
systemd-cryptenrollgenerates a random volume key secret, seals it within the TPM 2.0 chip under the designated PCR policy, and writes the token metadata to an open LUKS2 slot.
To verify the newly enrolled token, inspect the device key slots:
sudo cryptsetup luksDump /dev/nvme0n1p3You will observe a new token labelled systemd-tpm2 alongside your primary passphrase keyslot.
Configuring /etc/crypttab for TPM 2.0 Automatic Unlocking
For systemd to attempt TPM 2.0 unlocking during early userspace boot, update your crypttab configuration file:
sudo nano /etc/crypttabLocate the entry corresponding to your encrypted root partition and append the tpm2-device=auto option. For example:
root_crypt UUID=3c5d88f1-a1b2-4c3d-8e4f-9a0b1c2d3e4f none luks,tpm2-device=auto,discardSave the file and regenerate your initial ramdisk so the early boot environment includes the required TPM 2.0 drivers and systemd hooks:
On Debian/Ubuntu systems:
sudo update-initramfs -u -k allOn Fedora/RHEL/Arch systems running Dracut:
sudo dracut -f --regenerate-allEnrolling a FIDO2 Hardware Key for Physical Presence Unlocking
If you prefer physical two-factor authentication rather than purely unattended TPM boot, enrol a FIDO2/WebAuthn USB key (such as a YubiKey 5 series or Nitrokey):
sudo systemd-cryptenroll --fido2-device=auto /dev/nvme0n1p3To require both a user PIN and a physical touch gesture during boot:
sudo systemd-cryptenroll --fido2-device=auto --fido2-with-client-pin=yes --fido2-with-user-presence=yes /dev/nvme0n1p3Update /etc/crypttab by substituting or adding fido2-device=auto:
root_crypt UUID=3c5d88f1-a1b2-4c3d-8e4f-9a0b1c2d3e4f none luks,fido2-device=auto,discardRevoking and Removing Enrolled Tokens
If a hardware security key is misplaced, or if firmware updates alter PCR hashes requiring a clean reset, wipe the enrolled hardware slots while preserving your manual recovery passphrase:
sudo systemd-cryptenroll --wipe-slot=tpm2 /dev/nvme0n1p3
sudo systemd-cryptenroll --wipe-slot=fido2 /dev/nvme0n1p3Your original numeric or text passphrase remains fully active, ensuring uninterrupted administrative access.