Derive encryption key from PIN

Derive encryption key from PIN

[oSumAtrIX]

Hello,

I found this email in the README of the cryptsetup GitLab repository.

I am reaching out because I noticed that the PIN used to unseal the
decryption key from the TPM is not used to derive the decryption key.
The PIN is merely used as a policy, when it can also function in a
cryptographic context. The sealed key can further be encrypted with
the PIN, so that even a full compromise of the TPM including the
sealed key does not reveal the decryption key in cleartext. According
to
https://www.sstic.org/media/SSTIC2011/SSTIC-actes/bitlocker/SSTIC2011-Slides-bitlocker-bordes.pdf
BitLocker implements a KDF from the TPM PIN, but it seems to be
missing in LUKS.

Sincerely,
Ohan Melkonyan

Re: Derive encryption key from PIN

[Ondrej Kozina]

Hi,

On 14/07/2026 12:27, oSumAtrIX wrote:
> Hello,
> 
> I found this email in the README of the cryptsetup GitLab repository.
> 
> I am reaching out because I noticed that the PIN used to unseal the
> decryption key from the TPM is not used to derive the decryption key.
> The PIN is merely used as a policy, when it can also function in a
> cryptographic context. The sealed key can further be encrypted with
> the PIN, so that even a full compromise of the TPM including the
> sealed key does not reveal the decryption key in cleartext. According
> to
> https://www.sstic.org/media/SSTIC2011/SSTIC-actes/bitlocker/SSTIC2011-Slides-bitlocker-bordes.pdf
> BitLocker implements a KDF from the TPM PIN, but it seems to be
> missing in LUKS.

What do we talk about? systemd-tpm2 cryptsetup plugin? IIUCT it uses 
secret stored in TPM2 to get LUKS2 keyslot passphrase or KEK. The KEK 
later enter KDF to derive keyslot encryption key. And the keyslot 
contains encrypted volume key (MEK).

Or, there's some other plugin or application that seals the actual 
volume key?!

If there's something that could be improved in systemd-tmp2 plugin, 
please open RFE on systemd. They maintain the plugins for cryptsetup.

Best regards
O.

Re: Derive encryption key from PIN

[oSumAtrIX]

Hi,

> What do we talk about? systemd-tpm2 cryptsetup plugin? IIUCT it uses
> secret stored in TPM2 to get LUKS2 keyslot passphrase or KEK. The KEK
> later enter KDF to derive keyslot encryption key. And the keyslot
> contains encrypted volume key (MEK).
>
> Or, there's some other plugin or application that seals the actual
> volume key?!
>
> If there's something that could be improved in systemd-tmp2 plugin,
> please open RFE on systemd. They maintain the plugins for cryptsetup.
>
> Best regards
> O.

Please note that I have limited knowledge regarding the infrastructure
of LUKS or cryptsetup. Therefore, I would appreciate guidance on the
appropriate contact for my issue.

My understanding is that TPM+PIN authentication does not
cryptographically utilize the PIN. Instead, the PIN serves as a TPM
policy to seal the key. In contrast, BitLocker incorporates the PIN
into the cryptographic derivation of the decryption key. With
cryptsetup, the PIN's function is limited to sealing or saving a
secret. Consequently, within a threat model where the TPM is
compromised, the decryption key could be derived in plaintext without
the PIN, as the PIN merely acts as an access policy within the TPM.
The referenced paper demonstrates that BitLocker, however, uses the
PIN for key derivation. A specific KDF in BitLocker relies on both the
secret stored in the TPM and the PIN used to seal that secret, thus
making the final decryption key cryptographically dependent on the
PIN.

Regards,
Ohan Melkonyan

Re: Derive encryption key from PIN

[Ondrej Kozina]

On 14/07/2026 13:10, oSumAtrIX wrote:
> Hi,
> 
>> What do we talk about? systemd-tpm2 cryptsetup plugin? IIUCT it uses
>> secret stored in TPM2 to get LUKS2 keyslot passphrase or KEK. The KEK
>> later enter KDF to derive keyslot encryption key. And the keyslot
>> contains encrypted volume key (MEK).
>>
>> Or, there's some other plugin or application that seals the actual
>> volume key?!
>>
>> If there's something that could be improved in systemd-tmp2 plugin,
>> please open RFE on systemd. They maintain the plugins for cryptsetup.
>>
>> Best regards
>> O.
> 
> Please note that I have limited knowledge regarding the infrastructure
> of LUKS or cryptsetup. Therefore, I would appreciate guidance on the
> appropriate contact for my issue.

 From your description, I think it's related to systemd-tpm2 plugin. In 
that case you can contact systemd people via systemd-devel list[1] or 
take a look at systemd-tpm2 plugin sources[2].

I have ported systemd plugins into native libcryptsetup plugins some 
time ago (hosted in systemd repository), but there were many changes to 
those plugins over the time so the best approach would be to take a look 
and open RFE or Issue with issue description if there are concerns about it.

[1] https://lists.freedesktop.org/mailman/listinfo/systemd-devel
[2] https://github.com/systemd/systemd/

Best regards
O.

Re: Derive encryption key from PIN

[Milan Broz]

On 7/14/26 12:27 PM, oSumAtrIX wrote:
> I am reaching out because I noticed that the PIN used to unseal the
> decryption key from the TPM is not used to derive the decryption key.
> The PIN is merely used as a policy, when it can also function in a
> cryptographic context. The sealed key can further be encrypted with
> the PIN, so that even a full compromise of the TPM including the
> sealed key does not reveal the decryption key in cleartext. According
> to
> https://www.sstic.org/media/SSTIC2011/SSTIC-actes/bitlocker/SSTIC2011-Slides-bitlocker-bordes.pdf
> BitLocker implements a KDF from the TPM PIN, but it seems to be
> missing in LUKS.

Policies like FIPS strictly says that encryption key must be generated
from approved RNG. This is also LUKS logic (unless you specify
volume key explicitly).

What you probably mean is derived key to unlock keyslot (where volume key is stored).

And here it is up to token handling it, cryptsetup does not implement TPM unlocking,
it is systemd-cryptsetup/sysremd-cryptenroll configured token, so check policies there.

Anyway, Bitlocker TPM PIN is not used to derive encryption key either.
It can be used for TPMandPIN key protector (this is similar to LUKS keyslot).


Milan