{"slug": "systemd-cryptenroll", "name": "systemd-cryptenroll", "category": "security", "category_name": "Security and passwords", "description": "", "recommenders": 4, "commenters": 6, "warners": 2, "score": 1.738, "rising": -1.31, "first": "2026-01-28", "latest": "2026-07-20", "why": "Can also use systemd-cryptsetup/systemd-cryptenroll for this.", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 4, "neutral": 0, "compare": 0, "warn": 2}, "spark": [0, 0, 1, 0, 1, 0, 1, 0, 1, 0, 0, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "Can also use systemd-cryptsetup/systemd-cryptenroll for this.", "kind": "", "icon": true, "domain": "archlinux.org", "github_repo": null, "official_url": "https://www.freedesktop.org/software/systemd/man/latest/systemd-cryptenroll.html", "pricing": "", "aliases": ["systemd-cryptenroll"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 783619392, "item_id": 48976212, "url": "https://news.ycombinator.com/item?id=48976212", "by": "BatteryMountain", "date": "2026-07-20", "version": null, "stance": "recommend", "quote": "I use systemd-cryptenroll and a couple boot args.", "excerpt": "If you have a tpm (or virtual tpm), you can enroll your passphrase for auto unlock. When sealing the tpm slot, you can decide how much should be sealed: kernel version, drivers, firmware updates, hardware changes etc.. meaning a kernel update can break the seal and ask for passphrase if you included kernel version in the seal. You can set it so the kernel/driver updates won't break your tpm seals. It's usually just o", "context": "", "use_case": "TPM auto-unlock of disk encryption", "switched_from": "", "story": "Moonshine: Lets you stream games from your PC to any device running Moonlight"}, {"id": 756662880, "item_id": 47291430, "url": "https://news.ycombinator.com/item?id=47291430", "by": "jcgl", "date": "2026-03-07", "version": null, "stance": "recommend", "quote": "Can also use systemd-cryptsetup/systemd-cryptenroll for this.", "excerpt": "> 3. use clevis to enable automatic unlocking of the root fs only when secure boot check passes; Can also use systemd-cryptsetup/systemd-cryptenroll for this. I've not used clevis myself, but I'd imagine you have to do somewhat more rolling-your-own compared to the systemd tools. > The unified kernel image doesn't accept additional kernel parameters, so only parameters that are set during generation of the initram ar", "context": "", "use_case": "TPM disk unlock", "switched_from": "", "story": "Remotely unlocking an encrypted hard disk"}, {"id": 748835440, "item_id": 46802215, "url": "https://news.ycombinator.com/item?id=46802215", "by": "vladvasiliu", "date": "2026-01-28", "version": null, "stance": "recommend", "quote": "I've been using this for a few years now, and never had an issue.", "excerpt": "You can have automatic unlock with tpm2, with or without a pin, in addition to passphrase, file, fido2, pkcs#11 cert, or whatever else is supported by luks. I've been using this for a few years now, and never had an issue. https://wiki.archlinux.org/title/Systemd-cryptenroll > Imagine a motherboard failure and boom there goes my entire disk. You can also set a long-ass key in addition to the other methods, and back i", "context": "", "use_case": "LUKS auto-unlock with TPM2", "switched_from": "", "story": "Microsoft forced me to switch to Linux"}]}], "caveats": [{"label": "", "summary": "", "quotes": [{"id": 770752321, "item_id": 48172020, "url": "https://news.ycombinator.com/item?id=48172020", "by": "pregnenolone", "date": "2026-05-17", "version": null, "stance": "warn", "quote": "This flaw is particularly severe on Linux/cryptenroll", "excerpt": "Lots and lots of smattering around here. If anything, this is a secure boot flaw (and partially TPM), but that is a separate conversation. Also, it's been known for years that TPM based encryption should always be protected with a PIN for truly sensitive data: https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/countermeasures The author claims to be able to bypass T", "context": "", "use_case": "", "switched_from": "", "story": "Security researcher says Microsoft built a Bitlocker backdoor, releases exploit"}, {"id": 770157313, "item_id": 48134832, "url": "https://news.ycombinator.com/item?id=48134832", "by": "Borealid", "date": "2026-05-14", "version": null, "stance": "warn", "quote": "Cryptpentroll does not do this at all", "excerpt": "> That's not how it works. The KEK is not stored inside the TPM, but encrypted/decrypted by the TPM. No, the KEK is stored inside the TPM, and the DEK is decrypted by it. If you have three layers (two KEKs, one encrypted with the other) then sure. But at the end of the day one private key is actually stored inside the TPM, taking up as much space as the length of the key. To be specific, Bitlocker uses a stored key, ", "context": "", "use_case": "", "switched_from": "", "story": "Microsoft BitLocker \u2013 YellowKey zero-day exploit"}, {"id": 770135857, "item_id": 48133491, "url": "https://news.ycombinator.com/item?id=48133491", "by": "pregnenolone", "date": "2026-05-14", "version": null, "stance": "warn", "quote": "Cryptenroll doesn't (https://github.com/systemd/systemd/pull/27502), which is bad but has not been fixed", "excerpt": "> Since there's a ton of misunderstanding in this thread True. It's unfortunate, amd a lot of false information being spread there. > the KEK is stored inside the TPM That's not how it works. The KEK is not stored inside the TPM, but encrypted/decrypted by the TPM. > You could say \"why not make the KEK be a hash-mixed combination of a PIN and something inside the TPM?\". Bitlocker does that. Cryptenroll doesn't (https", "context": "", "use_case": "", "switched_from": "", "story": "Microsoft BitLocker \u2013 YellowKey zero-day exploit"}]}], "who": [], "tags": [], "use_cases": ["tpm auto-unlock of disk encryption", "tpm disk encryption on arch", "tpm disk unlock", "luks auto-unlock with tpm2"], "compared": [{"slug": "bitlocker", "name": "BitLocker", "co": 4, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=48130519", "title": "Microsoft BitLocker \u2013 YellowKey zero-day exploit", "mentions": 3}, {"url": "https://news.ycombinator.com/item?id=48972970", "title": "Moonshine: Lets you stream games from your PC to any device running Moonlight", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48168856", "title": "Security researcher says Microsoft built a Bitlocker backdoor, releases exploit", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47265521", "title": "Remotely unlocking an encrypted hard disk", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=46795864", "title": "Microsoft forced me to switch to Linux", "mentions": 1}], "sentiment_by_month": {"2025-11": {}, "2025-12": {}, "2026-01": {"recommend": 1}, "2026-02": {}, "2026-03": {"recommend": 1}, "2026-04": {}, "2026-05": {"warn": 2, "recommend": 1}, "2026-06": {}, "2026-07": {"recommend": 1}, "2026-08": {}, "2026-09": {}, "2026-10": {}}, "versions": [], "version_unnamed": 0, "family_ref": null, "runs_on": null, "lines": [], "quotes": [{"id": 783619392, "item_id": 48976212, "url": "https://news.ycombinator.com/item?id=48976212", "by": "BatteryMountain", "date": "2026-07-20", "version": null, "stance": "recommend", "quote": "I use systemd-cryptenroll and a couple boot args.", "excerpt": "If you have a tpm (or virtual tpm), you can enroll your passphrase for auto unlock. When sealing the tpm slot, you can decide how much should be sealed: kernel version, drivers, firmware updates, hardware changes etc.. meaning a kernel update can break the seal and ask for passphrase if you included kernel version in the seal. You can set it so the kernel/driver updates won't break your tpm seals. It's usually just o", "context": "", "use_case": "TPM auto-unlock of disk encryption", "switched_from": "", "story": "Moonshine: Lets you stream games from your PC to any device running Moonlight"}, {"id": 770752321, "item_id": 48172020, "url": "https://news.ycombinator.com/item?id=48172020", "by": "pregnenolone", "date": "2026-05-17", "version": null, "stance": "warn", "quote": "This flaw is particularly severe on Linux/cryptenroll", "excerpt": "Lots and lots of smattering around here. If anything, this is a secure boot flaw (and partially TPM), but that is a separate conversation. Also, it's been known for years that TPM based encryption should always be protected with a PIN for truly sensitive data: https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/countermeasures The author claims to be able to bypass T", "context": "", "use_case": "", "switched_from": "", "story": "Security researcher says Microsoft built a Bitlocker backdoor, releases exploit"}, {"id": 770375761, "item_id": 48148485, "url": "https://news.ycombinator.com/item?id=48148485", "by": "bri3d", "date": "2026-05-15", "version": null, "stance": "recommend", "quote": "", "excerpt": "Ubuntu does this with Hardware Backed Encryption option in the installer, which I think they\u2019re trying to move up the list (it\u2019s already the default in Ubuntu Core, which makes sense for that application). I didn\u2019t find it too difficult to set up TPM backed encryption on Arch using systemd-cryptenroll for my home server, although for anything I use interactively I just use a passphrase instead.", "context": "", "use_case": "TPM disk encryption on Arch", "switched_from": "", "story": "Microsoft BitLocker \u2013 YellowKey zero-day exploit"}, {"id": 770157313, "item_id": 48134832, "url": "https://news.ycombinator.com/item?id=48134832", "by": "Borealid", "date": "2026-05-14", "version": null, "stance": "warn", "quote": "Cryptpentroll does not do this at all", "excerpt": "> That's not how it works. The KEK is not stored inside the TPM, but encrypted/decrypted by the TPM. No, the KEK is stored inside the TPM, and the DEK is decrypted by it. If you have three layers (two KEKs, one encrypted with the other) then sure. But at the end of the day one private key is actually stored inside the TPM, taking up as much space as the length of the key. To be specific, Bitlocker uses a stored key, ", "context": "", "use_case": "", "switched_from": "", "story": "Microsoft BitLocker \u2013 YellowKey zero-day exploit"}, {"id": 770135857, "item_id": 48133491, "url": "https://news.ycombinator.com/item?id=48133491", "by": "pregnenolone", "date": "2026-05-14", "version": null, "stance": "warn", "quote": "Cryptenroll doesn't (https://github.com/systemd/systemd/pull/27502), which is bad but has not been fixed", "excerpt": "> Since there's a ton of misunderstanding in this thread True. It's unfortunate, amd a lot of false information being spread there. > the KEK is stored inside the TPM That's not how it works. The KEK is not stored inside the TPM, but encrypted/decrypted by the TPM. > You could say \"why not make the KEK be a hash-mixed combination of a PIN and something inside the TPM?\". Bitlocker does that. Cryptenroll doesn't (https", "context": "", "use_case": "", "switched_from": "", "story": "Microsoft BitLocker \u2013 YellowKey zero-day exploit"}, {"id": 756662880, "item_id": 47291430, "url": "https://news.ycombinator.com/item?id=47291430", "by": "jcgl", "date": "2026-03-07", "version": null, "stance": "recommend", "quote": "Can also use systemd-cryptsetup/systemd-cryptenroll for this.", "excerpt": "> 3. use clevis to enable automatic unlocking of the root fs only when secure boot check passes; Can also use systemd-cryptsetup/systemd-cryptenroll for this. I've not used clevis myself, but I'd imagine you have to do somewhat more rolling-your-own compared to the systemd tools. > The unified kernel image doesn't accept additional kernel parameters, so only parameters that are set during generation of the initram ar", "context": "", "use_case": "TPM disk unlock", "switched_from": "", "story": "Remotely unlocking an encrypted hard disk"}, {"id": 748835440, "item_id": 46802215, "url": "https://news.ycombinator.com/item?id=46802215", "by": "vladvasiliu", "date": "2026-01-28", "version": null, "stance": "recommend", "quote": "I've been using this for a few years now, and never had an issue.", "excerpt": "You can have automatic unlock with tpm2, with or without a pin, in addition to passphrase, file, fido2, pkcs#11 cert, or whatever else is supported by luks. I've been using this for a few years now, and never had an issue. https://wiki.archlinux.org/title/Systemd-cryptenroll > Imagine a motherboard failure and boom there goes my entire disk. You can also set a long-ass key in addition to the other methods, and back i", "context": "", "use_case": "LUKS auto-unlock with TPM2", "switched_from": "", "story": "Microsoft forced me to switch to Linux"}]}