morgan/systemd
1
0
Fork 0
mirror of https://github.com/morgan9e/systemd synced 2026-04-15 00:47:10 +09:00
Code Issues Packages Projects Releases Wiki Activity

docs: Update crypt{enroll,setup} limitations regarding FIDO2

Browse Source
This commit is contained in:
Peter Cai
2023-01-25 20:39:17 -05:00
parent 6ae3bd82d0
commit 820c66dcfc
1 changed files with 10 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
man/systemd-cryptenroll.xml
View File

@@ -64,17 +64,17 @@
<title>Limitations</title>
<para>Note that currently when enrolling a new key of one of the five supported types listed above, it is
required to first provide a passphrase or recovery key (i.e. one of the latter two key types). For
example, it's currently not possible to unlock a device with a FIDO2 key in order to enroll a new FIDO2
key. Instead, in order to enroll a new FIDO2 key, it is necessary to provide an already enrolled regular
passphrase or recovery key. Thus, if in future key roll-over is desired it's generally recommended to
combine TPM2, FIDO2, PKCS#11 key enrollment with enrolling a regular passphrase or recovery key.</para>
required to first provide a passphrase, a recovery key or a FIDO2 token. It's currently not supported to
unlock a device with a TPM2/PKCS#11 key in order to enroll a new TPM2/PKCS#11 key. Thus, if in future key
roll-over is desired it's generally recommended to ensure a passphrase, a recovery key or a FIDO2 token
is always enrolled.</para>
<para>Also note that support for enrolling multiple FIDO2 tokens is currently not too useful, as while
unlocking <command>systemd-cryptsetup</command> cannot identify which token is currently plugged in and
thus does not know which authentication request to send to the device. This limitation does not apply to
tokens enrolled via PKCS#11 — because tokens of this type may be identified immediately, before
authentication.</para>
<para>Also note that support for enrolling multiple FIDO2 tokens is currently limited. When multiple FIDO2
tokens are enrolled, <command>systemd-cryptseup</command> will perform pre-flight requests to attempt to
identify which of the enrolled tokens are currently plugged in. However, this is not possible for FIDO2
tokens with user verification (UV, usually via biometrics), in which case it will fall back to attempting
each enrolled token one by one. This will result in multiple prompts for PIN and user verification. This
limitation does not apply to PKCS#11 tokens.</para>
</refsect1>
<refsect1>