Auto-unlock LUKS at Boot with TPM2 and Clevis

Full-disk encryption with LUKS protects data at rest, but typing a passphrase on every boot is friction that leads people to disable encryption entirely on servers and unattended machines. Clevis and its TPM2 pin let the firmware unseals the LUKS key automatically—if and only if the measured boot state matches the policy you recorded. This guide walks through binding a LUKS volume to a TPM2 device, choosing which PCRs to seal against, testing the recovery path, and understanding exactly what threat model this does and does not cover.

How Clevis + TPM2 Works

Clevis is a pluggable key escrow framework. The clevis-luks package stores an encrypted JSON metadata object (a "JWE") inside a LUKS2 keyslot. At boot, clevis-initrd (or clevis-dracut) runs inside the initramfs, contacts the TPM2, and asks it to decrypt the JWE. The TPM2 only cooperates if the PCR values recorded at bind time match the current boot measurements. If they match, the disk unlocks with no human input. If they don't—wrong firmware, different kernel, tampered bootloader—the TPM refuses, and the system falls back to your manual passphrase.

Threat Model and Trade-offs

This setup protects against offline attacks: someone stealing the drive and reading it in another machine, or booting a live USB to copy raw LUKS data. It does not protect against:

• An attacker with physical access who can wait for an authenticated boot (the Evil Maid attack, partially mitigated by Secure Boot + PCR 7).
• A compromised OS after boot—once unlocked, the key is in kernel memory.
• TPM bus sniffing on discrete TPMs (fTPM inside the CPU is not susceptible).

Sealing against PCR 7 (Secure Boot state) and PCR 11 (systemd-boot / UKI measurements) gives a reasonable balance between security and update convenience. Sealing against PCR 0-5 (firmware internals) means every firmware update breaks the binding—you must re-bind after each UEFI update.

Prerequisites Check

Verify TPM2 is present and accessible:

ls /dev/tpm0 /dev/tpmrm0
systemctl status tpm2-abrmd 2>/dev/null || echo "using kernel resource manager"

Check that your root volume is LUKS2 (LUKS1 is not supported by clevis-tpm2):

cryptsetup luksDump /dev/nvme0n1p3 | grep Version

Output should show Version: 2. If it shows 1, convert with cryptsetup convert --type luks2 after a full backup—this is irreversible and risky.

Step 1 — Install Clevis

Debian / Ubuntu

apt install clevis clevis-luks clevis-tpm2 clevis-initramfs tpm2-tools

Fedora / RHEL 9 / Rocky Linux 9

dnf install clevis clevis-luks clevis-dracut clevis-systemd tpm2-tools

Arch Linux

pacman -S clevis tpm2-tools tpm2-tss

On Arch you must also install and enable clevis-dracut from AUR or configure mkinitcpio manually—see the Arch Wiki for the sd-encrypt hook setup.

Step 2 — Read Current PCR Values

Before binding, inspect what the TPM has measured in this boot session:

tpm2_pcrread sha256:0,1,2,3,4,5,6,7,8,9,11,14

Output lists each PCR bank and its current 32-byte digest. Note which PCRs are all-zeros (unmeasured/unused on your system) — including zeros in your policy wastes nothing but reduces specificity.

Recommended starting PCR set for a system with Secure Boot and systemd-boot:

• PCR 7 — Secure Boot state and enrolled keys (changes if you toggle Secure Boot).
• PCR 11 — systemd-boot and Unified Kernel Image (UKI) measurements; changes on kernel updates unless you re-sign the UKI.
• PCR 14 — MOK (Machine Owner Key) database changes.

For servers without Secure Boot, using PCR 4 (bootloader) and PCR 9 (initrd) is a pragmatic choice, accepting that firmware updates won't break the seal.

Step 3 — Bind LUKS to the TPM2

Replace /dev/nvme0n1p3 with your actual encrypted partition. The -k- flag reads the existing LUKS passphrase from stdin, which means clevis adds a new keyslot rather than replacing yours.

clevis luks bind -d /dev/nvme0n1p3 tpm2 '{"pcr_bank":"sha256","pcr_ids":"7,11,14"}'

Enter your existing LUKS passphrase when prompted. Clevis generates a random 512-bit key, seals it to the TPM2 with your PCR policy, and stores the JWE in a new LUKS keyslot.

Confirm the new keyslot was created:

clevis luks list -d /dev/nvme0n1p3

You should see a line like 1: tpm2 '{"hash":"sha256","pcr_ids":"7,11,14",...}'.

Step 4 — Update the initramfs

Debian / Ubuntu

update-initramfs -u -k all

Fedora / RHEL / Rocky

dracut -f --regenerate-all

Arch (mkinitcpio)

mkinitcpio -P

On systemd-boot with UKIs, the UKI must be rebuilt and re-signed after this step, otherwise PCR 11 will change on next boot and the seal will break immediately.

Step 5 — Verify Unlock at Boot

Before rebooting, confirm you still know your manual passphrase—write it down if needed. Then reboot and watch the boot messages:

systemctl reboot

If the disk unlocks without a prompt, Clevis succeeded. If the passphrase prompt appears, the TPM refused (PCR mismatch or misconfiguration). In that case, log in with your passphrase and check:

journalctl -b -u clevis-luks-askpass.service
journalctl -b | grep -i clevis

Step 6 — Test Manual Recovery

Simulate a failed TPM unlock (e.g., after a firmware update) by temporarily removing the clevis keyslot and unlocking manually:

# Do NOT do this in production without your passphrase confirmed
cryptsetup open /dev/nvme0n1p3 test_manual --key-file /dev/stdin
# Enter passphrase; then close it again
cryptsetup close test_manual

Your original passphrase keyslot (slot 0 by default) is untouched by clevis. Keep it. Never delete it.

Step 7 — Re-binding After Updates

Kernel or bootloader updates that change measured PCRs will break the existing seal. The workflow is:

1. Boot into the new kernel (you'll be prompted for a passphrase since TPM will refuse).
2. Remove the stale clevis slot: clevis luks unbind -d /dev/nvme0n1p3 -s 1 (replace 1 with your slot number).
3. Re-run the bind command from Step 3 to seal against the new PCR values.
4. Rebuild initramfs.

You can automate this with a post-kernel-install hook. Fedora/RHEL users can install clevis-dracut's included kernel-install hook which handles this automatically when using UKIs with systemd-measure and predicted PCR values (requires systemd >= 254).

Revoking TPM Access

If you sell or decommission the hardware, simply wipe the LUKS header or change the passphrase. The TPM-sealed key becomes useless because without the LUKS keyslot JWE, there is nothing to unseal. To explicitly remove the clevis binding:

clevis luks unbind -d /dev/nvme0n1p3 -s 1

Troubleshooting

• PCR mismatch after binding: You may have bound before updating the initramfs, changing the measured state. Unbind, rebuild initramfs, reboot once with passphrase, then re-bind.
• /dev/tpm0 permission denied: Add your user to the tss group or run as root. The tpm2-abrmd broker (if installed) handles access control via D-Bus.
• Clevis not found in initramfs: On Debian/Ubuntu, confirm clevis-initramfs is installed and check /usr/share/initramfs-tools/hooks/clevis exists. On dracut systems, verify the clevis dracut module is in /usr/lib/dracut/modules.d/.
• LUKS1 volume: Convert to LUKS2 first. Back up the header: cryptsetup luksHeaderBackup /dev/nvme0n1p3 --header-backup-file luks-header.bak.
• TPM2 not detected in firmware: Enable fTPM in UEFI settings (sometimes labeled "Security Device" or "PTT" on Intel systems).