Yes, I'm talking about the key the TPM returns. According to https://github.com/systemd/systemd/blob/25d9c6cdaf82d3f627db92b69f3be3e2a68e06fa/src/cryptenroll/cryptenroll-tpm2.c#L269, this gets base64-encoded and then used just like any passphrase.
And in line 265, is forces libcryptsetup to use a minimum version of PBKDF2.
It seems they assume the key returned by the TPM has a high enough entropy to make a proper KDF unnecessary. Is this a valid assumption?
Re: systemd-cryptenroll
And in line 265, is forces libcryptsetup to use a minimum version of PBKDF2.
It seems they assume the key returned by the TPM has a high enough entropy to make a proper KDF unnecessary. Is this a valid assumption?
-- sur5r