I use systemd-cryptenroll for TPM–based automatic unlock. I’m sure doing so is a bad idea for many reasons, but regardless, I noticed the LUKS keyslot that systemd-cryptenroll creates is hardcoded to pbkdf2.

Indeed, looking at the source, it appears this decision was made because the author “found the Wikipedia entry relevant”:

• https://github.com/systemd/systemd/blob/25d9c6cdaf82d3f627db92b69f3be3e2a68e06fa/src/cryptenroll/cryptenroll-tpm2.c#L182
• https://github.com/systemd/systemd/blob/25d9c6cdaf82d3f627db92b69f3be3e2a68e06fa/src/shared/tpm2-util.c#L3068