Fedora users can now unlock full disk encryption with a TPM2 chip instead of typing a passphrase
Full Disk Encryption on Fedora with TPM2
A hands-on walkthrough of LUKS2 full disk encryption on Fedora, from creating a volume and managing key slots to enrolling a TPM-bound key with systemd-cryptenroll. Binding to PCR 7, optionally with a PIN, lets the machine auto-unlock at boot while keeping a recovery key as a fallback. The final step edits crypttab and rebuilds the initramfs with dracut so the TPM2 module loads early enough.
Today I'm diving into the world of Secure Boot, TPM2, and all of the complications that come with wanting a high level of security without having to type a disk encryption key all the time.