Arch Linux

kallenosf

Member

Registered: 2025-08-29

Posts: 2

LUKS with TPM2 and Secure Boot

I'm setting up my system on a new laptop. I want to encrypt my system and I'm following LUKS on a partition with TPM2 and Secure Boot (paragraph 3).

In "3.8 Enrolling the TPM" there are some commands that, according to wiki, "will remove the empty passphrase created during the LUKS format process, create a key bound to the TPM and create a recovery key".

But I didn't get where that empty passphrase came from? Should I infer from this that in "3.2 Preparing the root partition" I must encrypt the disk with an empty passphrase? I don't think so cause there is a warning "Use a sufficiently secure password. Even though the keyslot will be wiped later..."

So at which point will I be creating this empty passphrase?

loqs

Member

Registered: 2014-03-06

Posts: 18,869

Re: LUKS with TPM2 and Secure Boot

The reference to the empty passphrase should have been removed as part of this wiki edit.