Systemd 248 To Allow Unlocking Encrypted Volumes Via TPM2 / FIDO2 / PKCS#11 Hardware

Written by Michael Larabel in systemd on 13 January 2021 at 03:06 PM EST. 11 Comments
For those with TPM2 security chips in your system or various hardware security tokens like YubiKeys, the upcoming systemd 248 will make it much easier to use then for unlocking your encrypted LUKS2 volumes.

While systemd-cryptsetup has already supported unlocking LUKs2 volumes at boot via user-supplied passphrases and key files on a local or removable disk, with systemd 248 will be the ability to make use of TPM2 / FIDO2 / PKCS#11 security hardware for unlocking volumes if desired.

The latest systemd-cryptsetup code has native support for unlocking LUKS2 volumes via FIDO2 security tokens (newer YubiKeys), TPM2 security chips (found in many laptops and other systems), or via PKCS#11 security tokens such as within smartcards and older YubiKeys. As another new feature, systemd 248 will also allow unlocking LUKS2 volumes via keys acquired through trivial AF_UNIX/SOCK_STREAM socket IPC.

More details on the new systemd-cryptsetup capabilities via Lennart's blog.
Related News
About The Author
Michael Larabel

Michael Larabel is the principal author of and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 20,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and automated benchmarking software. He can be followed via Twitter, LinkedIn, or contacted via

Popular News This Week