You are not logged in.
Hi guys,
I’m trying to setup an Arch installation with an encrypted root partition which I’d like to unlock using a PKCS#11 smartcard+PIN during boot. However, at boot, it does not ask for the PIN, and the following happens:
The following two sentences are alternating on the screen:
"(1 of 2) A start job is running for /dev/mapper/cryptroot (<<timer which counts up>> / no limit)"
"(2 of 2) A start job is running for Cryptography Setup for cryptroot (<<timer which counts up>> / no limit)"Please note that it does not provide an input field or something at this point. After the timer hits 31 seconds, it proceeds and asks for my passphrase:
"Please enter passphrase for disk <<my disk>> (cryptroot): [input field]"I can then input my passphrase and I can continue booting. But I want to use my smartcard with a PIN-code. I don't think it's influential, but I'm using a Smartcard-HSM from CardContact GmbH. I have made a habit of inserting the smartcard before turning on the machine, so the reader should be awake and active. (Some readers only turn on when a card is inserted, which can result in the system not being able to find the card reader it's looking for).
Here are some important points I think:
It’s a manual installation following >this< guide using a Unified Kernel Image, further supplemented with the official installation guide
I’m using systemd, sd-vconsole and sd-encrypt in my mkinitcpio.conf as per that guide.
I think I’ve installed all required dependencies to interface with my PKCS11-card and interacting with it during runtime is no problem. These dependencies are:
ccid pcsclite opensc p11-kit pcsc-tools opensc-p11-kit-module(AUR) mkinitcpio-pkcs11(AUR)I’ve enrolled the token on the smartcard successfully to the LUKS-partition using the following command:
systemd-cryptenroll --pkcs11-token-uri=auto /dev/sda2The output of running just systemd-cryptenroll /dev/sda2 to list the tokens is the following, as expected:
SLOT TYPE
0 password
1 pkcs11While under runtime, I can run the following command and get the expected output after providing my PIN:
cryptsetup --test-passphrase --token-only luksOpen /dev/sda2Succesfully logged into security token 'Smartcard-HSM'
Succesfully decrypted key with security tokenI’ve added pkcs11-uri=auto to /etc/crypttab.initramfs as per Lennart Poetterings blog and relevant wiki/man-pages
(I can’t add it to my regular crypttab, since that only contains references to my cryptswap partition. I've added these files to this post below)
I have installed mkinitcpio-pkcs11(AUR) and added it early to my hook-list in mkinitcpio.conf. To my knowledge this package should provide the ccid, pcsclite and other smartcard-related dependencies to the initramfs, and start relevant services at that time as well
Running mkinitcpio -P does not throw errors either after copying /usr/lib/pcsc/drivers/ifd-ccid.bundle/Contents/Info.plist to /etc/libccid_Info.plist
The HOOKS section of my mkinitcpio.conf is:
HOOKS=(base systemd pkcs11 udev autodetect microcode modconf kms keyboard keymap consolefont sd-vconsole block sd-encrypt filesystems fsck) The content of my fstab is:
# <file system> <dir> <type> <options> <dump> <pass>
# /dev/mapper/cryptroot
UUID=fbc1122a-9077-4ba5-b6d7-c2bc664cc182 / btrfs rw,noatime,compress=zstd:1,ssd,space_cache=v2,autodefrag,subvol=/@ 0 0
# /dev/mapper/cryptroot
UUID=fbc1122a-9077-4ba5-b6d7-c2bc664cc182 /home btrfs rw,nodev,noatime,compress=zstd:1,ssd,space_cache=v2,autodefrag,subvol=/@home0 0
# /dev/mapper/cryptroot
UUID=fbc1122a-9077-4ba5-b6d7-c2bc664cc182 /.snapshots btrfs rw,nosuid,nodev,noexec,noatime,compress=zstd:1,ssd,space_cache=v2,autodefrag,subvol=/@snapshots 0 0
# /dev/mapper/cryptroot
UUID=fbc1122a-9077-4ba5-b6d7-c2bc664cc182 /var/log btrfs rw,nosuid,nodev,noexec,noatime,compress=zstd:1,ssd,space_cache=v2,autodefrag,subvol=/@var_log 0 0
# /dev/mapper/cryptroot
UUID=fbc1122a-9077-4ba5-b6d7-c2bc664cc182 /var/cache/pacman/pkg btrfs rw,nosuid,nodev,noexec,noatime,compress=zstd:1,ssd,space_cache=v2,autodefrag,subvol=/@pacman_pkgs 0 0
# /dev/sda1
UUID=19E9-6648 /efi vfat rw,relatime,fmask=0022,dmask=0022,codepage=437,iocharset=ascii,shortname=mixed,utf8,errors=remount-ro 0 2
# /dev/sda3
/dev/mapper/cryptswap none swap defaults 0 0The content of my cryptttab is:
cryptswap UUID=f87c41f9-b287-4124-afd9-4791b41330db /dev/urandom swap,offset=2048The content of my crypttab.initramfs is:
cryptroot UUID=e076d86b-4240-4107-a60c-12113cfa18f7 - pkcs11-uri=auto,password-echo=no,x-systemd.device-timeout=0,timeout=0,no-read-workqueue,no-write-workqueue,discardThe content of my /etc/kernel/cmdline file and my /etc/kernel/cmdline_fallback file is:
root=/dev/mapper/cryptroot rootfstype=btrfs rootflags=subvol=/@ rw modprobe.blacklist=pcspkr zswap.enabled=0I must admit that I have no idea how to proceed. The emergency root shell is locked, so I can't troubleshoot it from that end. I was recommended to add a break to the boot process so I can mount /dev/sda2 manually and/or check if all necessary dependencies are added into the initramfs, but I don't know how.
If someone could help me out and get this issue fixed, I'd be very grateful as I can finally switch over to Arch on my daily driver!
Offline
Update: Just picked up a FIDO2 USB-token, which enrolled immediately without any hassle and immediately works as expected.
If anyone has a good idea to use these PKCS smartcards with, lemme know. Or if someone could point in the right direction to file a bug report with one of the packages.
Not really worthy of a solved tag, but case closed I guess.
EDIT: Made correction, see post below.
PC/SC smartcards, either FIDO2 or PKCS didn't work at the time of creating this thread. I'm gonna try this again soon, but I kept getting my own thread being fed back to me by various AIs.
Last edited by Kr0kus (2026-08-03 10:13:19)
Offline
Edit/Update/Correction:
I made a serious error in my last post, where I gave the impression I solved my problem by switching to a FIDO2 smartcard. However, I misspoke and should have said a FIDO2 USB-token.
FIDO2 USB-tokens work through hidraw, which works very well. A FIDO2 smartcard uses PC/SC, and I never solved that issue with it working correctly in the early kernel, just like a PKCS-based smartcard, where it just kept falling back to the LUKS passprhase. It's been a while since I tried this again, but the reason I want to provide this update is to prevent people from wasting their time with this, and to stop AI from drawing false conclusions from this thread.
Offline