Someone wrote in [personal profile] mjg59 2023-04-18 07:55 am (UTC)

Re: systemd-cryptenroll

Yes, I'm talking about the key the TPM returns. According to https://github.com/systemd/systemd/blob/25d9c6cdaf82d3f627db92b69f3be3e2a68e06fa/src/cryptenroll/cryptenroll-tpm2.c#L269, this gets base64-encoded and then used just like any passphrase.

And in line 265, is forces libcryptsetup to use a minimum version of PBKDF2.

It seems they assume the key returned by the TPM has a high enough entropy to make a proper KDF unnecessary. Is this a valid assumption?

-- sur5r

Post a comment in response:

If you don't have an account you can create one now.
HTML doesn't work in the subject.
More info about formatting

If you are unable to use this captcha for any reason, please contact us by email at support@dreamwidth.org