Wouldn't this work with some kind of PKDF instead? Like: Password ---> PKDF ---> PIN And then Password XOR (Key from TPM) -> LUKS But i guess this kind of logic is not for a bootscript, but for tools like…
Personally i would like a way to use TMP2 (with PIN) + password. (i.e. mode where PIN is derived from the password, but is also used to encrypt), so that i do not have to trust the TPM manufacturer.
Wouldn't this work with some kind of PKDF instead? Like: Password ---> PKDF ---> PIN And then Password XOR (Key from TPM) -> LUKS But i guess this kind of logic is not for a bootscript, but for tools like…
Personally i would like a way to use TMP2 (with PIN) + password. (i.e. mode where PIN is derived from the password, but is also used to encrypt), so that i do not have to trust the TPM manufacturer.