Derive encryption key from PIN

Hello,

I found this email in the README of the cryptsetup GitLab repository.

I am reaching out because I noticed that the PIN used to unseal the
decryption key from the TPM is not used to derive the decryption key.
The PIN is merely used as a policy, when it can also function in a
cryptographic context. The sealed key can further be encrypted with
the PIN, so that even a full compromise of the TPM including the
sealed key does not reveal the decryption key in cleartext. According
to
https://www.sstic.org/media/SSTIC2011/SSTIC-actes/bitlocker/SSTIC2011-Slides-bitlocker-bordes.pdf
BitLocker implements a KDF from the TPM PIN, but it seems to be
missing in LUKS.

Sincerely,
Ohan Melkonyan