This is an old revision of the document!

LUKS

Mount encrypted partition

cryptsetup luksOpen /dev/mmcblk1p3 mmcblk2p3_crypt
mount /dev/vgkubuntu/root /target # use lvdisplay to find the volume

Change key of encrypted partition

cryptsetup luksChangeKey /dev/sdX

Extend encrypted partition

https://unix.stackexchange.com/a/322631

Setup automatic unlock

apt install -y clevis clevis-luks clevis-udisks2 clevis-systemd clevis-tpm2 clevis-initramfs
clevis luks bind -d /dev/mmcblkp3 tpm2 '{"pcr_ids":"1,7","key":"rsa"}'
systemctl enable clevis-luks-askpass.path
update-initramfs -u -k all

Troubleshooting

If it doesn't work it might be due to wrong pcr_bank or key used. The PCR banks can be checked with tpm2_pcrread.

Regenerate

If automatic unlock does not work anymore it needs to be regenerated. First list the used slots:

clevis luks list -d /dev/nvme0n1p3

Then regenerate the used slot:

clevis luks regen -d /dev/nvme0n1p3 -s 1

Change PCRs

To change PCRs you first need to delete the key and then re-add using the wanted PCRs.

List the used slots:

clevis luks list -d /dev/nvme0n1p3

Remove the slot:

clevis luks unbind -d /dev/nvme0n1p3 -s 1 -f

Note: -f will not ask for confirmation but is needed if there is no other slot set up.

After that re-add the key like above.

Patchouli's Library

Table of Contents