TPM (PCR 7 + 11) Setup Failure.

LeFauconBlanc · 2026-07-19 23:41:56

Hello, I have a dual-booted ThinkPad T14 Gen 3 AMD, Arch Linux (KDE Plasma Wayland) and Windows 11. A Windows update occured and my TPM + PIN (PCR 7 + 11) broke. I've tried cryptenroll with just PCR 7 and it did work, so I've pinpointed the problem to PCR 11. I've tried regenerating PCR public and private keys and still get TPM policy does not match current system state. Either system has been tempered with or policy out-of-date: Operation not permitted. I've tried clearing TPM in BIOS then re-enrolling.

If anybody can give me some resources that touch on this situation more or point out the problem I'd really appreciate it. If I don't include enough of my situation, please ask for more.

[lefauconblanc@m0bileTank ~]$ cat /etc/kernel/uki.conf
# This file is part of systemd.
#
# systemd is free software; you can redistribute it and/or modify it under the
# terms of the GNU Lesser General Public License as published by the Free
# Software Foundation; either version 2.1 of the License, or (at your option)
# any later version.
#
# Ini-style configuration file for ukify(1) which is only effective when
# $KERNEL_INSTALL_LAYOUT or layout= in install.conf is set to uki and
# $KERNEL_INSTALL_UKI_GENERATOR or uki_generator= in install.conf is set to
# ukify, or is unset. $KERNEL_INSTALL_CONF_ROOT may be used to override the
# search path.
#
# See kernel-install(8) for details.

[UKI]
#Initrd=
#Microcode=
#Splash=/usr/share/systemd/bootctl/splash-arch.bmp
PCRPKey=/etc/systemd/tpm2-pcr-keys/tpm2-pcr-public-key.pem
#PCRBanks=
#SecureBootSigningTool=sbsign
#SecureBootPrivateKey=/etc/kernel/secure-boot-private-key.pem
#SecureBootCertificate=/etc/kernel/secure-boot-certificate.pem
#SecureBootCertificateDir=
#SecureBootCertificateName=
#SecureBootCertificateValidity=
#SigningEngine=
#SignKernel=

[PCRSignature:initrd]
PCRPrivateKey=/etc/systemd/tpm2-pcr-keys/tpm2-pcr-private-key.pem
PCRPublicKey=/etc/systemd/tpm2-pcr-keys/tpm2-pcr-public-key.pem
#Phases=enter-initrd

[lefauconblanc@m0bileTank ~]$ sudo ukify inspect /boot/efi/Linux/fe916b87c8864f5d9525d549af8b8132-7.1.4-arch1-1.efi
.sbat:
size: 325 bytes
sha256: 653af6e3ca67a4a0d9e1c85e67810caa071e36fcb49302dc62b8013ed0725fb2
text:
sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
systemd-stub,1,The systemd Developers,systemd,261,https://systemd.io/
systemd-stub.arch,1,Arch Linux,systemd,261.1,https://archlinux.org/packages/core/x86_64/systemd/
uki,1,UKI,uki,1,https://uapi-group.org/specifications/specs/unified_kernel_image/
.osrel:
size: 382 bytes
sha256: 71ff7a6e248d9a0718344c957ec709cb6f0b18631682fa404d7cff2af3ff341d
text:
NAME="Arch Linux"
PRETTY_NAME="Arch Linux"
ID=arch
BUILD_ID=rolling
ANSI_COLOR="38;2;23;147;209"
HOME_URL="https://archlinux.org/"
DOCUMENTATION_URL="https://wiki.archlinux.org/"
SUPPORT_URL="https://bbs.archlinux.org/"
BUG_REPORT_URL="https://gitlab.archlinux.org/groups/archlinux/-/issues"
PRIVACY_POLICY_URL="https://terms.archlinux.org/docs/privacy-policy/"
LOGO=archlinux-logo
.cmdline:
size: 541 bytes
sha256: 5aa986ad050d89cec236040017f0761aca2cce5d319591e407bf1973cf2654e9
text:
rd.luks.name=1994193e-269f-46a6-a781-25dffb534165=arch-root rd.luks.name=41c23ed9-dfe6-4729-aa18-33c8bf28e473=arch-swap root=/dev/mapper/arch-root rd.luks.options=arch-root:tpm2-device=auto resume=/dev/mapper/arch-swap rd.luks.optio
ns=arch-swap:tpm2-device=auto tpm_tis.interrupts=0 splash quiet loglevel=3 systemd.show_status=auto rd.udev.log_level=3 vt.global_cursor_default=0 lsm=landlock,lockdown,yama,integrity,apparmor,bpf audit=1 audit_backlog_limit=16384 btusb
.enable_autosuspend=0 systemd.machine_id=fe916b87c8864f5d9525d549af8b8132
.uname:
size: 13 bytes
sha256: 59df3a99744710b755986600297ef0658046e9c2a8a4adaf7cdd1e4874aa84a4
text:
7.1.4-arch1-1
.pcrpkey:
size: 451 bytes
sha256: 9e71cb3a02d2b87029e3524ad0fa1a446c9a238b360520ec66ccacc986e03af8
text:
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAiQVTgXRQ8oQFgotb8Y0s
u95yZuzOra/L36B9f65cH4K4R1QaPWehUbhue6dZAN/N0RKhm4+PWioJ1AfZmjG5
x+54cwVWbKA5tW8JeqVcTKjzDhZvYo7JtlJfJ4HypBpgQWfTFlPu9fuXZ47NprZk
REIj4fikkWG1aEgvwQHTQw8enEeHLup2XhRQJ9RxU/F1ir43CdjojMS8xFaEKj3E
M+iYZPGWz+fRc5aibhb/KrOCoxgYMo3TVYrhgIHWpj6NmE5kwsoWQtfAsfFQ1gdp
CMVA+dTusIaT/w2DyAYY9JOWPzWaAqH0IPhjgbL4VYhLzGmKaEAq0bIZYLhngfPl
YQIDAQAB
-----END PUBLIC KEY-----
.linux:
size: 17076736 bytes
sha256: 442c4d5513d726cfcc8c7e8ec54bfa68efb30db2be8caec6ecbb5c3f90ece0d8
.initrd:
size: 57518980 bytes
sha256: 67834e386d14dec1018a1dc0d3a816249fbb65f7d7333ff6358803b8f2cde100
.pcrsig:
size: 8398 bytes
sha256: c4aa7441b5be754aa5edfea1689903d4455c48485400a24dfef9c91d4c066594
text:
{"sha1": [{"pcrs": [11], "pkfp": "d85efb34efd1ef86ebbfd5d59f06f7d465d0e51f12bc7d70db4cf22f7d260b14", "pol": "0e9f25a0821b85259aad106daf35be0182e94c75866b558e4071e6f7eeeafd84", "sig": "bhGw4uDC4X/s+gEt3esgRP2mLW4PUVEsW5NtMObdlbVaGNLY
g0j7RV4pQv7++ImN15mBegAbrmePUNO8QhLGsvdE8ik0QNBdSq/NgUmG01+r7dD57d4wm+cMiTYDbzw2/3kpGfWFZF57loZK849XdYItl+KKq23xJRHsa8reFOfwPu5wXbI6/MpO+CtcF2X2sJ59OqDcJZvQvF1NocQvVU1hMNK8jfjwjm8EIeW4O+9/a9dQ8UV9zSVBg9qXTu8OadEUL1BuBzMdIgvY/6kEiGEV651h
hmLBMCN5i+acHS14WT8fY6gpjOICIFZLTT3Hnw7T2tV1B6A/dYxYytrVkQ=="}, {"pcrs": [11], "pkfp": "d85efb34efd1ef86ebbfd5d59f06f7d465d0e51f12bc7d70db4cf22f7d260b14", "pol": "15dfb34d5343d09f1496dedfbdf0ead23ed243a80971d0501ecc1b45d37c33ec", "sig":
"c/cWf9Ih39dQjIwb52y16ommtJq9khXEOiMCdMndn/fCPUnOVzKaJL7PCA2NIeU1fcoqnks0BsS3ho7VTjwPzaYH3AVeDO4Lmgiehwh1c/gMNNeKM3uwpc6gvgssxlFrIK6NgJNyBIsaGE/072egY1xVe3lsUTWNZSEO3oQe+dtssK69tm1hoqrM+dNlDyhgX2pf4cUjU1GcH4EtNtjNWfQ0ChWxLtVMZ6X6yJs9GL
YYH1EILK2qXo+9Fdk/eulRF1M8o/zv4Ur57TOXcOLLfmPPpD9Lp0pECc6ZEJ8Ao7gihTGoHvtv+GI3Ixr32zjon5oO7TkO1sRCCgbuS8f56Q=="}, {"pcrs": [11], "pkfp": "d85efb34efd1ef86ebbfd5d59f06f7d465d0e51f12bc7d70db4cf22f7d260b14", "pol": "04a605b621da69705195863
df6d32b1a7763d73061a5ff9412adb6d6cc6f631d", "sig": "cOLgEPyVE3xll8YT5sOa912qgNP5+ow9lz9e6sgr+QedkZgd7tJpVxUZb48VTw1V+87CAl2L/IjX21y+cKB6AC5J9QF/zqHSZX/FWNXieV8exE+XdFCZ40jlAKJFPjCB9MOz2w+G0wGuFmFEcMWzr+IIzXb5LXukXV9fl34xQbBJrGiNyQRTZQ5W
UR5mkUUURRwoUtzb/tYZlR5kJ8+BY7dOcKet83rmNzEXhw7YVuqEPiMAswKOdcaLjay7v/S0Bb7GhMgHHbVS8YAfcQAkwgoHTAsIcopePZhETYDU3GcuTXEoLs3m5bvUEqHdkU5klqBx0PyKs+6DKVaRTJQeJw=="}, {"pcrs": [11], "pkfp": "d85efb34efd1ef86ebbfd5d59f06f7d465d0e51f12bc7d70
db4cf22f7d260b14", "pol": "e1fd80c5195143efff66b4a38fae25853cabb3916f9319f4dce1506c8e492e33", "sig": "Q6rkFZR56JKMvJ+KamAxFmT7w/UOGaKiPdLWIsMBnPSKd9YAdj5gLCi8B4FhnP/0dPDEIyq9mEr7H1/Wb2Z1NCleq3ik6F5KjPkB8h/GtGAmr2MAGD5E1w+9jxCCbIPrlTSUP/
yJSJr9rRRhViNyChQV0FqfFofZ6nlKnwTWQ/zH5mQEdKBl5onDLE7s2UJzuVgCxODVHEouIj93aLdFswFhI649DkljgBqw5nSF78wlwsu1zzzYgr1IPwE1bNA58AEnB4CEYbljysU6h56QFZHjglq86aUgCSgofTlGC1se1qX6jDI0tUzT9hpQQkzsLE9GQt5ZTy7ppQ/7B6Kikg=="}], "sha256": [{"pcrs": [
11], "pkfp": "d85efb34efd1ef86ebbfd5d59f06f7d465d0e51f12bc7d70db4cf22f7d260b14", "pol": "f35eda479739bafb47006456b38bbf7fa099750c3271ab751951b8df970807cb", "sig": "Lp20DGnyRpiGqulKBdDzPEjvE//aGvWbQAkFdf6YPasEB1bM5G8FqDvOLaF5T73PBOs4wR5/
0O+DGqGNBlRvakO7QQtxgRmsmKGtxyjByjrGVhjMeNj9H8cPisE1sGH9nEN1PbDo86yDXAkLwzkhRZxi/+eKwPfsSuz2lQA+CYh7wWDDI+IuJu3xcJ174ZpYJV6pc02hKdIAlM8C/j+4OT6ayHYe5Z5hAn9qG/gI4XZgFHEXK14XsjMmASZwAPiZPO5Ptly0cWPU4PwGmcrfz0d5UZpj8+8EFQQ1eG0LIMoNv/9U5/2e
RAbd2n6qN/5iWCXgZLZ5I6DV+ImeTh7Bng=="}, {"pcrs": [11], "pkfp": "d85efb34efd1ef86ebbfd5d59f06f7d465d0e51f12bc7d70db4cf22f7d260b14", "pol": "d747751bf0f9b73df34ebec36fa7a1cabc270ab88f51d9ad11667c3f860ae493", "sig": "KisVGLh4Et41JEQygI/hRb
Nb7FQx1knEtGQzlkfueq9vBoKE1So7ktHXmVhmoWmh6ro0j/b5y2SmTQSbaCiZuhn6C/Dp58k17Lv8EcHBXUTP/jNcUn+9NTvYU6sE03sqZXmwoB4GqMybGZzH8Sm8i86x65yalCTjAXlYawKrR38qI4GmqQAvTDGN4TRJgMT4BiTIcQ38Vi0hvDtWfwaStYTiLGioQKKqM+0W6da45DtmEg2OivBSjWF4Sl4WjWXi36
k6rEfL+zE+1Tg4MoDFVKVj1HIEH5YIn3zjTMJ1n/w1zcNhXlycjgz/gm7oVXvx7xeKQ1wkya+0tCTMHB2Eww=="}, {"pcrs": [11], "pkfp": "d85efb34efd1ef86ebbfd5d59f06f7d465d0e51f12bc7d70db4cf22f7d260b14", "pol": "4eef6144e278e72b7984b8dd6e25550c3903de2cc5b7f83
0c4cb5272912a6339", "sig": "GoO0V02xq4J5p8+EdxOKxCXINbEwe/NlvkAp+veqilmh55K+jkDOIMLp3WHRWS5UoACcCdrWydgJVj5CIVDhPKOzZyhq1HRjvhO7dDBkeRRStsk+qFox/bf/cgiRs0l+44zr43q1e4huoqPxuLs3Hg9QwngfVKucVaE8K2GhnzRsYDEIVx7TXTnJZyJ86AOAzhNqWyYFm83WsW6j
XjHMHWfBWz0bOfI7m7Gtee90RfipoI/WFVM0z0feuE8itQn2RMTWG5wOVk3rk6+KrD9VGlAhfgDQg1swXfvNTX3azrF31gRWbWDx/n+PifrC9NNwtbpcBWtX7tRTMidl8ocTxg=="}, {"pcrs": [11], "pkfp": "d85efb34efd1ef86ebbfd5d59f06f7d465d0e51f12bc7d70db4cf22f7d260b14", "pol"
: "42766b2d25f9ea50925ffafb7879f6feaf0c6e60c92ceab9e1062194119ec7f7", "sig": "Y9qm4rlbvE5G/TcVeYnJFESxBOtO3vpC0H64+qY9VGN4AfvKkmme7vS8bqsaQqSHY3f0vvj2pKv+qf1SXjyvs0UDmLn3XB/VAQmmZ+733CGO1ipR1vxiX/Tr6U13cvoj5nSr/vJ0BNjqmzUWEkspI18fW6VunK
7eI4g02HvmFIJzjfWJZDHRhc8yr56iJ8epE7AKZ81db88lVdiDVDdDSPYHJc2KNeH9BnXYelHAdwGNGNfG8jcTHEZMA2QG+8LADdokzlg8VZepnPKyw5Tzi5jFWh5d8Ff0diD8GQEXcqraqCxZ8ozdqypoC+OzvFh5tPb0Cfy2PBG4up9jQPmNHw=="}], "sha384": [{"pcrs": [11], "pkfp": "d85efb34ef
d1ef86ebbfd5d59f06f7d465d0e51f12bc7d70db4cf22f7d260b14", "pol": "06b01c0ce05fc88ef7a6f6d380db5aa5b8b6cfb27c17654780d05f00abd65684", "sig": "TF+/dy4v2UjcX0kbQyF6fa+jo/mNMPwf401Jj28Pa/Fe/8tDVp38heuDCoHK2bxSgi5KaQ9YRU099sDS3no8nEorLfWJSTWp
P8/uj4dOWV0kIEPPnycvua+8NwKkGdvJx9MJV1ijluJkjBqU7N8+cwn4zA0gIxPRUFcoTRfql+75ghGP5ayOhXWJRDXOiZFr/dM+XsXxqjAKBoiek8uKId5Yenqp2KwCusExgCNXZgKRu84oKzvwjVgpp+HnY5D7qTgnyqr+WHNL//Ex77ftO5Eu2VlxSZCxoKnvWwWq5//YE7xlTl7ameN49zCuUmzRCST4Le3V23NF
BYhbqLNzEw=="}, {"pcrs": [11], "pkfp": "d85efb34efd1ef86ebbfd5d59f06f7d465d0e51f12bc7d70db4cf22f7d260b14", "pol": "16f496b2493074eaf7ef72e42cc25b0a489194825c33ba91fb19a1fae2e0dc33", "sig": "Wsd6/MRIb8uP6o81cl9Y0IdEkNltrG0j3ZEhdMNkcgWvOm
gXeVmDAYdm+V7g0sEzjo1TEAtsfVaPKbT7X+Q1LcCdPCwAMUVo7zMmJZczkpH6IDN+2VrgGufsV0ramkiTvN/zmBeo6p96nCaYG2aBMsH65m+a6dbU6NcPGr/3aabXl9kq6IhpOZwO3uBVZL92sgEwy22EMSEFHg8TyjYs1DXOvBxmUpeQXsbVkNbvKqvi3RWrTtVGr0c/l3F+9RYecpab/g2ExlpOb+ha5MhGE//6uX
+FNoHKciobhNGHA9HoTCyJvYaFPLKZVK00V2s45T4T+mG6GRcmXXHiHYUb7g=="}, {"pcrs": [11], "pkfp": "d85efb34efd1ef86ebbfd5d59f06f7d465d0e51f12bc7d70db4cf22f7d260b14", "pol": "839eba11eb506324ced2e86fe6055322c047c2b71ca2add668a2d8ed09e5f032", "sig
": "YmoHDP4PID+gxS5BfOq2nz0sbJAd8sHvWUq/oQiuHhGiSCmLpcym7yRgZuaPoZVwABfA8pf0AIXUrbmP0HbYmMu6BkbIQ454q1HNMEOPiimS67lZTfKgp0vKggFjsmn7K+3SFU3FpQguatSWGIkVD9kdRQqyuNjc24mi/RbNRtR0+NPKtLdrQaOQFUaGJnM+pWBUO9tIvQC+Ddv1BoMGq9OfKiVnhVIcSGJ6LYq0
7UXkHEiyIMzT/4/XAEb6mj+w52zF2PdS/AvMXsnvjriSNQEqELKxtviWrz4e0avWvfKL+pzCDORgzIpM8p0h9zA3IyoRYwLgfLyIkwBw05RjHg=="}, {"pcrs": [11], "pkfp": "d85efb34efd1ef86ebbfd5d59f06f7d465d0e51f12bc7d70db4cf22f7d260b14", "pol": "291133f2dda53e98c3859
7f3f76f31e83aff6a49a5f283a9526343a106b1fadc", "sig": "N6jF8SX71NsgZsnDlnb6NTAQZV4ASMyvkcAlmJdrdkfiPBNhrbBOz+9a7hR0wB3OGrrUR7L/KDWlzx7TpRD5NRl2Hl/kIUK5yZAEmDAqPKEt1bWwcVtiwcK0CzDUkmivIjehpzv+MI191dDUb94PQczddeDNUWTlRYJScZsli8bOcjQ3+AemAr
ai9rXkPAPX8bFR1gyrsV40D9AFUeKPkkPDkhOZPwGQv/ARRI17y2I441oHRirxhibXcHQZuFXop7SP7Lqn4BwMCMfOFwJ6mVPqxw/KlZ83rpfpNAu5omjlgJKsFjtHRsRPP97CjVHZVRPpJtFz1QdD209T4WQonQ=="}], "sha512": [{"pcrs": [11], "pkfp": "d85efb34efd1ef86ebbfd5d59f06f7d465
d0e51f12bc7d70db4cf22f7d260b14", "pol": "40de7d58cb2beae0d20a39e9d5ed7fa90ad85f03d32e77a96ac7b593e02ec2db", "sig": "YRxh2Qy7B07I/8Ru57rpfwTnWwdAmS4RZRHdEqc6w7YIRTJw31++DRjpXM1mWevSW4VXuQ/IFlUrB1H5QAEzCzQHSgerMClIT73OwoXuwKGVawhIqC0mDQQl
1jaSuUVVEZSD7rRsveldmBZm+OOTvP8AcnUJj+RwNcthk19PTLh2WZobzscGXEa9tmIKVQV4NvLOGPaiH1jUy3BTBIr6hiXMsYd8KsAw2c4ybHzABxZCeWANaZRp22KzuyaWHbJVjil98MGiFYw3PwKushvpQrTj1/adbtm6Be8ptCH8fWTNfUBgZ/mTpr8TY3fsx3K+PtzCKYvq+bHq2fCVjlic7w=="}, {"pcrs":
[11], "pkfp": "d85efb34efd1ef86ebbfd5d59f06f7d465d0e51f12bc7d70db4cf22f7d260b14", "pol": "a5f4ea37223618d4d2465574ce3839bc4289895f588d83872efb3e61df34f012", "sig": "Az4wrKYgW1pdc/+KFLj0QlWXSJxggP4uqkRvop1CkQnbc7LjfbUGYQzB/N6TJCLdE54T+V
ZSpFT58EpZ/3yX638zx6p0XwQa+KRO4w/2id+REYmxUJhIAq1l8a3oDeaEx+6UBvMWvjqXw3cZSia99+O13BhutsIwNNfM0+VZZlPdoXuGIMdg5HHVgNSU6WfuHTe6Mdsn6SCxAbUTnRzLrz6B8BpRXev+nopHJ7Qd5Z50ey2yYAnfaDQr1yT70Sl5p0P5l3pGrA/iaNS0RSdjLNZ41dcnQI7zUpCAVaaad+Pg1iTkJL
oyF0MzfNEp7lqcPrrZ3/cyV45mgaXcbQYrHw=="}, {"pcrs": [11], "pkfp": "d85efb34efd1ef86ebbfd5d59f06f7d465d0e51f12bc7d70db4cf22f7d260b14", "pol": "def273c8211fa2f69f24f1c7e827285d26c07c10baa52581b489af821fc64b92", "sig": "hunGQoQxKEhOhZscwJBa
4eOJ/rI/q0Chax8Xl5ph333lbGLZrxgU6bj5xMEp+7MGQcZ6viAwKOfqtwwurMFOTXnCjlS0+edCpqjdqqZMKsaGywg+WJzvFej5OkV57RfqJuWdSYCSW+8j97JgdYnjlgL8XfYkLrNz31d3MrMidDq0HuILriUiqtsjeFmbQDP3QcTxJK6fG3DXrIK2byyqdcZBce+HJ7K9uuQ0JhBv/wj7ejf8FerCLpgiSSnd9ySz
VdpX1bRcctxqd5bg0McdfX4ra4hvvKEUZdq6dfggI4nEwEefVnE6vgGhzP/fEG5xUtPG3n1GuisZpZIfwUIzrA=="}, {"pcrs": [11], "pkfp": "d85efb34efd1ef86ebbfd5d59f06f7d465d0e51f12bc7d70db4cf22f7d260b14", "pol": "201c345fe6b0bb1693848bed643d4f73ab0be3cb0acc3
9c22cc257c8c5bd93fb", "sig": "AhDV3Pj0gv0aZJeaj3t9R70Jhiw49CROlrIvC9xG6LdYshWUUwOqQTgnitdYOHqabCdXEDXWOB9MzBcvhsbNlggwDsWVvWbIe+Y0E2PFsT5nPSzNJcTTzmexOpmPK/0Y8vEsjmKYoAoIoc9YPyFkQEsev/VgSwmWQx1XJ+9mgXPk/Hg046h/ICP9XphiE4xJIcxR3Qg+bGCWen
UObMLh8qlhnWxwpu+EHEXZZrawykfFIufDKPuSL6+xl7i7Ty5eSPpMrcwYzYIf9sghi2naV4Knfg541/C1EjKESLYW14NuAisxD8bi5FLUcWQzonlA71IKPW/tMz61ZmoT6c/N2A=="}]}

[lefauconblanc@m0bileTank ~]$ systemd-analyze pcrs
NR NAME SHA256
0 platform-code e4c529bcd991bce2b073a8cfffc642f98b00afea98eb48a647a05baf528f8c3b
1 platform-config a3b3daeb1ecd973507346469dee4dd2cd77049b8c99383780a5b06471b1cb3c5
2 external-code d1e729ad881cea3f548aa7d63aaae05b02a57e2424245203bdb1f2a914088f80
3 external-config 3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969
4 boot-loader-code bb52a724c85ac37c2286d601ad2f060249f38dc0bde80f6ea3bfb0b18a98be43
5 boot-loader-config 8af5bf06cac287211d4b8b4c7f20ad228e368a4b6e0137b2eb4688218690cd07
6 host-platform 3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969
7 secure-boot-policy b0cb045cb82dd833d12fbe2866e3fd0f75945cd8dd776948cc255b5369f41398
8 - 0000000000000000000000000000000000000000000000000000000000000000
9 kernel-initrd e3aa2874996ac9b50d62f891f6abbc072ab2794885e2572ba9f3924cc46cd976
10 ima 0000000000000000000000000000000000000000000000000000000000000000
11 kernel-boot baa1b41191c86bbe4dcb3d4e6e7d0ca9ce58c162184c8396d7c6fd1d62d48f90
12 kernel-config 06235990c438721d8901ab9ac8875b6cbaa462203746921a83c594a9921e411a
13 sysexts 0000000000000000000000000000000000000000000000000000000000000000
14 shim-policy 0000000000000000000000000000000000000000000000000000000000000000
15 system-identity 0000000000000000000000000000000000000000000000000000000000000000
16 debug 0000000000000000000000000000000000000000000000000000000000000000
17 - ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
18 - ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
19 - ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
20 - ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
21 - ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
22 - ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
23 application-support 0000000000000000000000000000000000000000000000000000000000000000

[lefauconblanc@m0bileTank ~]$ sudo cryptsetup luksDump /dev/nvme0n1p5
LUKS header information
Version: 2
Epoch: 193
Metadata area: 16384 [bytes]
Keyslots area: 16744448 [bytes]
UUID: 1994193e-269f-46a6-a781-25dffb534165
Label: systemd-tpm2
Subsystem: (no subsystem)
Flags: (no flags)

Data segments:
0: crypt
offset: 16777216 [bytes]
length: (whole device)
cipher: aes-xts-plain64
sector: 512 [bytes]

Keyslots:
0: luks2
Key: 512 bits
Priority: normal
Cipher: aes-xts-plain64
Cipher key: 512 bits
PBKDF: argon2id
Time cost: 9
Memory: 1048576
Threads: 4
Salt: d3 dd 09 62 84 2c 7f b5 5c ba 9a 67 75 fb 92 a8
14 1d da 86 3c 57 1b e2 4b c6 c9 c8 f2 9e 3d eb
AF stripes: 4000
AF hash: sha256
Area offset:290816 [bytes]
Area length:258048 [bytes]
Digest ID: 0
1: luks2
Key: 512 bits
Priority: normal
Cipher: aes-xts-plain64
Cipher key: 512 bits
PBKDF: pbkdf2
Hash: sha512
Iterations: 1000
Salt: 28 b8 e3 e2 1e 17 52 17 d7 e8 4f d0 35 04 f4 73
a7 c5 a0 e7 d1 8c 60 1c e5 d5 62 b8 cd 80 69 4e
AF stripes: 4000
AF hash: sha512
Area offset:32768 [bytes]
Area length:258048 [bytes]
Digest ID: 0
Tokens:
0: systemd-tpm2
tpm2-hash-pcrs: 7+11
tpm2-pcr-bank: sha256
tpm2-pubkey:
2d 2d 2d 2d 2d 42 45 47 49 4e 20 50 55 42 4c 49
43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 49 42 49
6a 41 4e 42 67 6b 71 68 6b 69 47 39 77 30 42 41
51 45 46 41 41 4f 43 41 51 38 41 4d 49 49 42 43
67 4b 43 41 51 45 41 69 51 56 54 67 58 52 51 38
6f 51 46 67 6f 74 62 38 59 30 73 0a 75 39 35 79
5a 75 7a 4f 72 61 2f 4c 33 36 42 39 66 36 35 63
48 34 4b 34 52 31 51 61 50 57 65 68 55 62 68 75
65 36 64 5a 41 4e 2f 4e 30 52 4b 68 6d 34 2b 50
57 69 6f 4a 31 41 66 5a 6d 6a 47 35 0a 78 2b 35
34 63 77 56 57 62 4b 41 35 74 57 38 4a 65 71 56
63 54 4b 6a 7a 44 68 5a 76 59 6f 37 4a 74 6c 4a
66 4a 34 48 79 70 42 70 67 51 57 66 54 46 6c 50
75 39 66 75 58 5a 34 37 4e 70 72 5a 6b 0a 52 45
49 6a 34 66 69 6b 6b 57 47 31 61 45 67 76 77 51
48 54 51 77 38 65 6e 45 65 48 4c 75 70 32 58 68
52 51 4a 39 52 78 55 2f 46 31 69 72 34 33 43 64
6a 6f 6a 4d 53 38 78 46 61 45 4b 6a 33 45 0a 4d
2b 69 59 5a 50 47 57 7a 2b 66 52 63 35 61 69 62
68 62 2f 4b 72 4f 43 6f 78 67 59 4d 6f 33 54 56
59 72 68 67 49 48 57 70 6a 36 4e 6d 45 35 6b 77
73 6f 57 51 74 66 41 73 66 46 51 31 67 64 70 0a
43 4d 56 41 2b 64 54 75 73 49 61 54 2f 77 32 44
79 41 59 59 39 4a 4f 57 50 7a 57 61 41 71 48 30
49 50 68 6a 67 62 4c 34 56 59 68 4c 7a 47 6d 4b
61 45 41 71 30 62 49 5a 59 4c 68 6e 67 66 50 6c
0a 59 51 49 44 41 51 41 42 0a 2d 2d 2d 2d 2d 45
4e 44 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d
2d 2d 0a
tpm2-pubkey-pcrs: 11
tpm2-primary-alg: ecc
tpm2-pin: true
tpm2-pcrlock: false
tpm2-salt: true
tpm2-srk: true
tpm2-pcrlock-nv: false
tpm2-policy-hash:
c7 46 a4 90 40 a6 e8 33 6a a2 78 59 b2 30 d4 f8
9a 6b df b1 ba c4 4f f5 5e b8 cc e7 0f ae b7 5f
tpm2-blob: 00 9e 00 20 4b 8d c4 f3 ae 28 05 78 6a 0c 94 3a
c5 dc a6 93 a6 a8 ce 89 99 d4 a0 5a ba 56 bd 1d
73 72 4b f4 00 10 3d 54 33 f3 15 6a 5c 27 cd 8f
05 25 3b a6 f0 c7 8e d0 a1 63 73 e1 c6 8d a7 f5
af 95 f9 9a 79 64 74 48 dd d4 b0 60 77 88 a2 1a
47 d8 ab 68 6e 92 2e 8d 98 a0 ac 67 3e 7d d8 27
b5 90 ef 16 c3 32 33 8e 79 57 4c 63 ca 29 8d 2d
c7 dd 88 29 e3 c2 ba c8 1b b7 c2 46 b6 6e 7b b7
b0 71 d9 e4 e2 90 72 15 79 3d 35 f2 00 4f b6 04
0b 73 bc b5 b3 cd 78 1d 90 92 9a 65 1c 05 55 50
00 4e 00 08 00 0b 00 00 00 12 00 20 c7 46 a4 90
40 a6 e8 33 6a a2 78 59 b2 30 d4 f8 9a 6b df b1
ba c4 4f f5 5e b8 cc e7 0f ae b7 5f 00 10 00 20
ce 86 15 ae 47 9c dd fd 26 d1 60 77 8f 2e 2c ca
c9 b8 2d cb 8d ae bf 96 f0 f9 8e f2 31 4f 11 42
Keyslot: 1
Digests:
0: pbkdf2
Hash: sha256
Iterations: 370783
Salt:
31
2a
a5
59
b1
79
95
26
d9
1b
66
6e
06
1b
6b
ef

87
a1
34
bf
ea
9a
68
aa
e6
76
98
ad
9c
83
be
d3
Digest:
05
97
96
fb
9f
63
f1
93
48
e5
90
b5
e8
3c
40
a5

d7
44
d1
90
c3
d8
6b
7b
ee
91
24
be
f8
22
64
47
Command successful.

[lefauconblanc@m0bileTank ~]$ sudo cryptsetup luksDump /dev/nvme0n1p6
LUKS header information
Version: 2
Epoch: 169
Metadata area: 16384 [bytes]
Keyslots area: 16744448 [bytes]
UUID: 41c23ed9-dfe6-4729-aa18-33c8bf28e473
Label: systemd-tpm2
Subsystem: (no subsystem)
Flags: (no flags)

Data segments:
0: crypt
offset: 16777216 [bytes]
length: (whole device)
cipher: aes-xts-plain64
sector: 512 [bytes]

Keyslots:
0: luks2
Key: 512 bits
Priority: normal
Cipher: aes-xts-plain64
Cipher key: 512 bits
PBKDF: argon2id
Time cost: 9
Memory: 1048576
Threads: 4
Salt: 7f aa f5 73 63 3f 64 a3 b3 4d a9 68 f5 12 6c a4
07 d6 bd 06 7a 99 3a 5d 51 bb 12 3e 81 57 90 18
AF stripes: 4000
AF hash: sha256
Area offset:290816 [bytes]
Area length:258048 [bytes]
Digest ID: 0
1: luks2
Key: 512 bits
Priority: normal
Cipher: aes-xts-plain64
Cipher key: 512 bits
PBKDF: pbkdf2
Hash: sha512
Iterations: 1000
Salt: 31 61 14 68 48 c6 8f 88 6c d6 bc 38 b0 8b 7c a9
e5 af dd e8 64 88 39 05 ba cc d1 1e f6 46 69 95
AF stripes: 4000
AF hash: sha512
Area offset:32768 [bytes]
Area length:258048 [bytes]
Digest ID: 0
Tokens:
0: systemd-tpm2
tpm2-hash-pcrs: 7+11
tpm2-pcr-bank: sha256
tpm2-pubkey:
2d 2d 2d 2d 2d 42 45 47 49 4e 20 50 55 42 4c 49
43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 49 42 49
6a 41 4e 42 67 6b 71 68 6b 69 47 39 77 30 42 41
51 45 46 41 41 4f 43 41 51 38 41 4d 49 49 42 43
67 4b 43 41 51 45 41 69 51 56 54 67 58 52 51 38
6f 51 46 67 6f 74 62 38 59 30 73 0a 75 39 35 79
5a 75 7a 4f 72 61 2f 4c 33 36 42 39 66 36 35 63
48 34 4b 34 52 31 51 61 50 57 65 68 55 62 68 75
65 36 64 5a 41 4e 2f 4e 30 52 4b 68 6d 34 2b 50
57 69 6f 4a 31 41 66 5a 6d 6a 47 35 0a 78 2b 35
34 63 77 56 57 62 4b 41 35 74 57 38 4a 65 71 56
63 54 4b 6a 7a 44 68 5a 76 59 6f 37 4a 74 6c 4a
66 4a 34 48 79 70 42 70 67 51 57 66 54 46 6c 50
75 39 66 75 58 5a 34 37 4e 70 72 5a 6b 0a 52 45
49 6a 34 66 69 6b 6b 57 47 31 61 45 67 76 77 51
48 54 51 77 38 65 6e 45 65 48 4c 75 70 32 58 68
52 51 4a 39 52 78 55 2f 46 31 69 72 34 33 43 64
6a 6f 6a 4d 53 38 78 46 61 45 4b 6a 33 45 0a 4d
2b 69 59 5a 50 47 57 7a 2b 66 52 63 35 61 69 62
68 62 2f 4b 72 4f 43 6f 78 67 59 4d 6f 33 54 56
59 72 68 67 49 48 57 70 6a 36 4e 6d 45 35 6b 77
73 6f 57 51 74 66 41 73 66 46 51 31 67 64 70 0a
43 4d 56 41 2b 64 54 75 73 49 61 54 2f 77 32 44
79 41 59 59 39 4a 4f 57 50 7a 57 61 41 71 48 30
49 50 68 6a 67 62 4c 34 56 59 68 4c 7a 47 6d 4b
61 45 41 71 30 62 49 5a 59 4c 68 6e 67 66 50 6c
0a 59 51 49 44 41 51 41 42 0a 2d 2d 2d 2d 2d 45
4e 44 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d
2d 2d 0a
tpm2-pubkey-pcrs: 11
tpm2-primary-alg: ecc
tpm2-pin: true
tpm2-pcrlock: false
tpm2-salt: true
tpm2-srk: true
tpm2-pcrlock-nv: false
tpm2-policy-hash:
c7 46 a4 90 40 a6 e8 33 6a a2 78 59 b2 30 d4 f8
9a 6b df b1 ba c4 4f f5 5e b8 cc e7 0f ae b7 5f
tpm2-blob: 00 9e 00 20 42 9a 18 fc 21 b6 32 00 be a8 bf e3
c7 2d f7 4e 8c 0d f9 d0 06 3e dc 1f fb 71 70 05
45 0d 8c 09 00 10 86 7f 6b d4 05 ae 9e 1a 23 b5
ed 24 7b 1e aa 10 14 27 7d 1a bf 65 85 88 00 2d
3f 51 fb 8c fc 9d 43 be 7d 80 b4 6d 0b 9c b9 ee
67 e0 31 84 70 a8 ae cf d3 ee 99 49 5a 64 c1 7e
6c 38 87 fd 0c eb c9 a2 5c 79 81 96 13 59 3e 3b
95 b7 41 4c 30 27 e2 c3 3f a0 1e a9 bf fa e0 26
3d 33 38 39 82 4a 5c 8f aa a6 f8 69 3f c2 e9 40
23 8a e6 cf 06 55 d4 a3 e9 9c 72 98 40 a9 b7 0b
00 4e 00 08 00 0b 00 00 00 12 00 20 c7 46 a4 90
40 a6 e8 33 6a a2 78 59 b2 30 d4 f8 9a 6b df b1
ba c4 4f f5 5e b8 cc e7 0f ae b7 5f 00 10 00 20
58 71 6c de 54 44 69 92 55 fb 63 db a5 12 a6 25
d0 f6 e2 a7 d0 29 ff 6c 11 41 4e b3 ad 0f f5 54
Keyslot: 1
Digests:
0: pbkdf2
Hash: sha256
Iterations: 371308
Salt:
ed
45
2d
1f
c6
dd
ec
ad
a2
de
d8
ee
4f
29
1c
03

95
a6
2c
a6
7a
70
0f
42
a3
61
eb
56
95
89
b7
2f
Digest:
1d
29
8c
a9
22
54
12
2f
9c
0e
bc
2d
4e
80
54
aa

24
2d
eb
fc
4f
b7
4f
59
25
b6
ed
7a
2a
bb
86
c4
Command successful.
[lefauconblanc@m0bileTank ~]$

seth · 2026-07-20 05:58:17

Please use [code][/code] tags. Edit your post in this regard.

x-ref, https://bbs.archlinux.org/viewtopic.php?id=314164

Arch Linux

#1 2026-07-19 23:41:56

TPM (PCR 7 + 11) Setup Failure.

#2 2026-07-20 05:58:17

Re: TPM (PCR 7 + 11) Setup Failure.

Board footer