Fedora TPM2 LUKS Disk Auto Decryption

2026-06-11 03:23

Enable Secure Boot (since TPM will unseal when secure boot is turned on afterwards)

To safely enable secure boot if you use NVIDIA proprietary drivers, you first need to create a self signed MOK and then enroll this with the system. Do this first, (needs to reboot), and once you've logged in again, reboot into BIOS and enable secure boot.

Find your LUKS encrypted volumes

#sudo blkid -t TYPE="crypto_LUKS"
/dev/nvme0n1p6: UUID="7785009c-67ea-4be4-88a5-d2b19d1de91c" TYPE="crypto_LUKS" PARTUUID="40961f68-ce0a-4897-b045-5534a67c397a"

Enroll TPM with specific Platform Configuration Register's (PCR) set. PCRs are used to tell TPM in what system state should the enrolled key be accessible. For example, 7 is for secure boot, so if secure boot is changed after enrolling a key, the secret cannot be retrieved. I do not believe flipping works. Once it's "unsealed" it remains unsealed.

# sudo systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+2+4+7+8+9 /dev/nvme0n1p6
🔐 Please enter current passphrase for disk /dev/nvme0n1p6: ••••••••    
New TPM2 token enrolled as key slot 1.

You can find more well-known PCR definitions here

https://www.freedesktop.org/software/systemd/man/latest/systemd-cryptenroll.html

In Case of Unsealing

Installing a new kernel will trigger an unseal. You can replace the key like so.

# sudo systemd-cryptenroll /dev/nvme0n1p6 --wipe-slot=tpm2 --tpm2-device=auto --tpm2-pcrs=0,2,4,7,8,9

Edit /etc/crypttab

https://man7.org/linux/man-pages/man5/crypttab.5.html

sudo nano /etc/crypttab

Replace none discard with the following

- tpm2-device=auto,discard,tpm2-measure-pcr=yes

# cat /etc/crypttab
luks-7785009c-67ea-4be4-88a5-d2b19d1de91c UUID=7785009c-67ea-4be4-88a5-d2b19d1de91c - tpm2-device=auto,discard,tpm2-measure-pcr=yes

Edit /etc/default/grub

Add rd.luks.options=tpm2-device=auto to the GRUB_CMDLINE_LINUX line

sudo nano /etc/default/grub

# HOW MINE LOOKS
# elopez@fedora:~$ sudo grep  CMDLINE /etc/default/grub
# GRUB_CMDLINE_LINUX="EXISTING COMMANDS rd.luks.options=tpm2-device=auto"

Recovery Key (OPTIONAL)

I'm not doing this

sudo systemd-cryptenroll --recovery-key /dev/nvme0n1p6

Verify and reboot!

# sudo systemd-cryptenroll /dev/nvme0n1p6
SLOT TYPE    
   0 password
   1 tpm2
# if you add a recovery key, it will be listed