Currently, to setup auto-unlocking a FDE LUKS partition using a TPM, an user needs to…
- Figure out how to use systemd-cryptenroll/clevis.
- What each PCR value actually represents.
It would be great if the Anaconda installer allowed an user to enroll their TPM2 chip during installation for convenience and ease of use.
Windows 11 and macOS already have similar FDE setups enabled ootb, and the Ubuntu installer has an option for this, although it is still experimental.
Has any progress been made on implementing such a feature so far ?
What are everyone’s thoughts on this ?