how to use "cryptomount -k KEYFILE -s"

[rohde-schwarz]

how to use "cryptomount -k KEYFILE -s"

[neusdan]

Hi,

"For what I understand, -K KEYFILE specifies the file to use by LUKS, so no more nead to use a password"

yes exactly.

"and -s mean unsealing the file (decrypt ?) using the unseal command of the TPM"

yes, the file is unsealed by TrustedGRUB2. The information to which PCRs the file is sealed is contained in the sealed blob.

The Sealing itself can't be done by TrustedGRUB2 itself. We have our own library for tpm operations, so i haven't tested it, but i think you could use tpm_sealdata to seal the keyfile. Currently this is only possible with the SRK and the well known secret (20 zero bytes)