Re: LUKS breaks When using fido key with pin

On 1/29/26 3:48 PM, Alistair MacCallum wrote:
> I'm having an issue getting my fido key to work with LUKs, at boot it prompts me for the pin and user presence twice then fails instead of falling back to the password that's available. I have the same issue across 3 different laptops and 3 different Yubikeys. I'm also able to reproduce it on a clean install. If I set it up without the PIN it works as expected, it's only with the PIN that it fails.

This activation logic is run by systemd utils (or other wrappers above cryptsetup), so the best would be to ask in systemd forum or list.

Also, 2.7.0 is old versions we no longer support upstream, so it would be better reporting this to Ubuntu (if they still support it).

Milan

> 
> System Details
> - Ubuntu Server 24.03
> - Using dracut instead of initramfs
> - FIDO key is a Yubikey 5C NFC
> - Crypttab, udev rules and dracut conf I assume are correct as the fido key works if enrolled without a PIN
> - cryptsetup v2.7.0
> - libfido2-1 v1.14.0
> 
> 
> The command used to enroll the key was
> 
> sudo systemd-cryptenroll /dev/nvme0n1p3 --fido2-device=auto --fido2-with-client-pin=no --fido2-with-user-presence=yes
> 
> Any help would be greatly appreciated!
> 
> 
> Kind Regards,
> Alistair MacCallum
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
>