[tpm2] Re: How to initialize a used TPM2 module and thoughts on clevis

Very useful, thank you!

> and YES. This is required to keep someone from wiping all the keys in
> the owner hierarchy which would include your disk encryption keys.
> You also want to set the lockoutauth as well.

It appears clevis uses the owner hierarchy by default. If I set an owner password, what are the implications, does clevis need to know the owner password when it creates its own key and then encrypts/decrypts its own key?

This is how I'm trying to use it to encrypt a single file on disk (not the entire disk/LUKS):
https://manpages.ubuntu.com/manpages/focal/man1/clevis-encrypt-tpm2.1.html