Re: Derive encryption key from PIN

[Milan Broz <gmazyland@gmail.com>]

On 7/14/26 12:27 PM, oSumAtrIX wrote:
> I am reaching out because I noticed that the PIN used to unseal the
> decryption key from the TPM is not used to derive the decryption key.
> The PIN is merely used as a policy, when it can also function in a
> cryptographic context. The sealed key can further be encrypted with
> the PIN, so that even a full compromise of the TPM including the
> sealed key does not reveal the decryption key in cleartext. According
> to
> https://www.sstic.org/media/SSTIC2011/SSTIC-actes/bitlocker/SSTIC2011-Slides-bitlocker-bordes.pdf
> BitLocker implements a KDF from the TPM PIN, but it seems to be
> missing in LUKS.

Policies like FIPS strictly says that encryption key must be generated
from approved RNG. This is also LUKS logic (unless you specify
volume key explicitly).

What you probably mean is derived key to unlock keyslot (where volume key is stored).

And here it is up to token handling it, cryptsetup does not implement TPM unlocking,
it is systemd-cryptsetup/sysremd-cryptenroll configured token, so check policies there.

Anyway, Bitlocker TPM PIN is not used to derive encryption key either.
It can be used for TPMandPIN key protector (this is similar to LUKS keyslot).


Milan