Re: Derive encryption key from PIN

Hi,

> What do we talk about? systemd-tpm2 cryptsetup plugin? IIUCT it uses
> secret stored in TPM2 to get LUKS2 keyslot passphrase or KEK. The KEK
> later enter KDF to derive keyslot encryption key. And the keyslot
> contains encrypted volume key (MEK).
>
> Or, there's some other plugin or application that seals the actual
> volume key?!
>
> If there's something that could be improved in systemd-tmp2 plugin,
> please open RFE on systemd. They maintain the plugins for cryptsetup.
>
> Best regards
> O.

Please note that I have limited knowledge regarding the infrastructure
of LUKS or cryptsetup. Therefore, I would appreciate guidance on the
appropriate contact for my issue.

My understanding is that TPM+PIN authentication does not
cryptographically utilize the PIN. Instead, the PIN serves as a TPM
policy to seal the key. In contrast, BitLocker incorporates the PIN
into the cryptographic derivation of the decryption key. With
cryptsetup, the PIN's function is limited to sealing or saving a
secret. Consequently, within a threat model where the TPM is
compromised, the decryption key could be derived in plaintext without
the PIN, as the PIN merely acts as an access policy within the TPM.
The referenced paper demonstrates that BitLocker, however, uses the
PIN for key derivation. A specific KDF in BitLocker relies on both the
secret stored in the TPM and the PIN used to seal that secret, thus
making the final decryption key cryptographically dependent on the
PIN.

Regards,
Ohan Melkonyan