systemd-cryptenroll
Fewer than 5 people recommend it so far, so there's no written verdict. Here is what commenters said.
4recommend
2warn against
Jan 28, 2026first mention
Jul 20, 2026latest mention
Why people recommend it
“I use systemd-cryptenroll and a couple boot args.”
“Can also use systemd-cryptsetup/systemd-cryptenroll for this.”
Show 1 more
“I've been using this for a few years now, and never had an issue.”
Caveats and dissent
“This flaw is particularly severe on Linux/cryptenroll”
“Cryptpentroll does not do this at all”
Show 1 more
“Cryptenroll doesn't (https://github.com/systemd/systemd/pull/27502), which is bad but has not been fixed”
Often compared with
Threads where it came up
- Microsoft BitLocker – YellowKey zero-day exploit 3 mentions
- Moonshine: Lets you stream games from your PC to any device running Moonlight 1 mention
- Security researcher says Microsoft built a Bitlocker backdoor, releases exploit 1 mention
- Remotely unlocking an encrypted hard disk 1 mention
- Microsoft forced me to switch to Linux 1 mention
Data: systemd-cryptenroll.json. Quotes are verbatim; the verdict and theme labels are written by a model from these comments, and every clause links to its sources.
All comments 7
“I use systemd-cryptenroll and a couple boot args.”
“This flaw is particularly severe on Linux/cryptenroll”
Ubuntu does this with Hardware Backed Encryption option in the installer, which I think they’re trying to move up the list (it’s already the default in Ubuntu Core, which makes sense for that application). I didn’t find it too difficult to set up TPM backed encryption on Arch using systemd-cryptenroll for my home server, although for anything I use interactively I just use a passphrase instead.
“Cryptpentroll does not do this at all”
“Cryptenroll doesn't (https://github.com/systemd/systemd/pull/27502), which is bad but has not been fixed”
“Can also use systemd-cryptsetup/systemd-cryptenroll for this.”
“I've been using this for a few years now, and never had an issue.”