Use TPM2 for automatic FDE unlocking

Prerequisite

• The disk is already encrypted using LUKS.
• A passphrase is required for unlocking the partition.
• The package tpm2-tools is available.

Enroll TPM2 using systemd

Find the encrypted partition using lsblk

# lbslk
...
└─nvme0n1p3                 259:3    0   1.8T  0 part
  └─dm_crypt-0              252:0    0   1.8T  0 crypt
...

# systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+7 /dev/nvme0n1p3
🔐 Please enter current passphrase for disk /dev/nvme0n1p3: ••••••••••••••••••••••••••••••••

Update /etc/crypttab

- dm_crypt-0 UUID=12345678-1234-5678-1234-abcdefg12345 none luks
+ dm_crypt-0 UUID=12345678-1234-5678-1234-abcdefg12345 none luks,tpm2-device=auto

update-initramfs -u

Reboot!