Re: Derive encryption key from PIN

[Ondrej Kozina <okozina@redhat.com>]

On 14/07/2026 13:10, oSumAtrIX wrote:
> Hi,
> 
>> What do we talk about? systemd-tpm2 cryptsetup plugin? IIUCT it uses
>> secret stored in TPM2 to get LUKS2 keyslot passphrase or KEK. The KEK
>> later enter KDF to derive keyslot encryption key. And the keyslot
>> contains encrypted volume key (MEK).
>>
>> Or, there's some other plugin or application that seals the actual
>> volume key?!
>>
>> If there's something that could be improved in systemd-tmp2 plugin,
>> please open RFE on systemd. They maintain the plugins for cryptsetup.
>>
>> Best regards
>> O.
> 
> Please note that I have limited knowledge regarding the infrastructure
> of LUKS or cryptsetup. Therefore, I would appreciate guidance on the
> appropriate contact for my issue.

 From your description, I think it's related to systemd-tpm2 plugin. In 
that case you can contact systemd people via systemd-devel list[1] or 
take a look at systemd-tpm2 plugin sources[2].

I have ported systemd plugins into native libcryptsetup plugins some 
time ago (hosted in systemd repository), but there were many changes to 
those plugins over the time so the best approach would be to take a look 
and open RFE or Issue with issue description if there are concerns about it.

[1] https://lists.freedesktop.org/mailman/listinfo/systemd-devel
[2] https://github.com/systemd/systemd/

Best regards
O.