{"guid":"23b0213c-cfe6-5daf-a7f9-dd6bb7cafcec","title":"Proposal for TPM2+FIDO2 enrollment in systemd","subtitle":null,"slug":"all-systems-go-2026-394-proposal-for-tpm2-fido2-enrollment-in-systemd","link":"https://cfp.all-systems-go.io/all-systems-go-2026/talk/SD3X9L/","description":"User space based Full Disk Encryption in openSUSE is old news. We already can set up FDE installations using the systemd toolset. This allows us to use traditional passwords, the TPM2 to validate the status before mounting the encrypted device or a FIDO2 key to validate the presence of a token owned by authorized users. To increase the security, in Tumbleweed, we recommend combining both TPM2 and a password (TPM2+PIN). This guarantees the system is in a healthy state and the user has the correct authorization, but it still doesn't support a combination of TPM2 and FIDO2 keys. To fix this issue, we are proposing a new enrollment method in systemd: TPM2+FIDO2.\n\nLicensed to the public under https://creativecommons.org/licenses/by/4.0/de/","original_language":"eng","persons":["Alberto Planas Dominguez"],"view_count":14,"promoted":false,"date":"2026-09-30T10:45:00.000+02:00","release_date":"2026-09-30T00:00:00.000+02:00","updated_at":"2026-09-30T22:45:14.472+02:00","tags":["394","2026","asg2026","Loft","asg2026-eng","asg2026","Day 1"],"length":1307,"duration":1307,"thumb_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/394-23b0213c-cfe6-5daf-a7f9-dd6bb7cafcec.jpg","poster_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/394-23b0213c-cfe6-5daf-a7f9-dd6bb7cafcec_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/394-23b0213c-cfe6-5daf-a7f9-dd6bb7cafcec.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/394-23b0213c-cfe6-5daf-a7f9-dd6bb7cafcec.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/all-systems-go-2026-394-proposal-for-tpm2-fido2-enrollment-in-systemd","url":"https://api.media.ccc.de/public/events/23b0213c-cfe6-5daf-a7f9-dd6bb7cafcec","conference_title":"All Systems Go! 2026","conference_url":"https://api.media.ccc.de/public/conferences/asg2026","related":[],"recordings":[{"length":1307,"mime_type":"video/mp4","language":"eng","filename":"asg2026-394-eng-Proposal_for_TPM2_FIDO2_enrollment_in_systemd_hd.mp4","state":"new","folder":"h264-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2026-09-30T12:10:57.814+02:00","label":"eng 1080p","size":60,"recording_url":"https://cdn.media.ccc.de/events/all_systems_go/2026/h264-hd/asg2026-394-eng-Proposal_for_TPM2_FIDO2_enrollment_in_systemd_hd.mp4","url":"https://api.media.ccc.de/public/recordings/105546","event_url":"https://api.media.ccc.de/public/events/23b0213c-cfe6-5daf-a7f9-dd6bb7cafcec","conference_url":"https://api.media.ccc.de/public/conferences/asg2026"},{"length":1307,"mime_type":"video/webm;codecs=av01","language":"eng","filename":"asg2026-394-eng-Proposal_for_TPM2_FIDO2_enrollment_in_systemd_av1-hd.webm","state":"new","folder":"av1-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2026-09-30T12:34:08.307+02:00","label":"eng 1080p","size":81,"recording_url":"https://cdn.media.ccc.de/events/all_systems_go/2026/av1-hd/asg2026-394-eng-Proposal_for_TPM2_FIDO2_enrollment_in_systemd_av1-hd.webm","url":"https://api.media.ccc.de/public/recordings/105559","event_url":"https://api.media.ccc.de/public/events/23b0213c-cfe6-5daf-a7f9-dd6bb7cafcec","conference_url":"https://api.media.ccc.de/public/conferences/asg2026"},{"length":1307,"mime_type":"audio/opus","language":"eng","filename":"asg2026-394-eng-Proposal_for_TPM2_FIDO2_enrollment_in_systemd_opus.opus","state":"new","folder":"opus","high_quality":false,"width":0,"height":0,"updated_at":"2026-09-30T12:40:05.981+02:00","label":"eng","size":12,"recording_url":"https://cdn.media.ccc.de/events/all_systems_go/2026/opus/asg2026-394-eng-Proposal_for_TPM2_FIDO2_enrollment_in_systemd_opus.opus","url":"https://api.media.ccc.de/public/recordings/105571","event_url":"https://api.media.ccc.de/public/events/23b0213c-cfe6-5daf-a7f9-dd6bb7cafcec","conference_url":"https://api.media.ccc.de/public/conferences/asg2026"},{"length":1307,"mime_type":"audio/mpeg","language":"eng","filename":"asg2026-394-eng-Proposal_for_TPM2_FIDO2_enrollment_in_systemd_mp3.mp3","state":"new","folder":"mp3","high_quality":false,"width":0,"height":0,"updated_at":"2026-09-30T12:40:09.686+02:00","label":"eng","size":20,"recording_url":"https://cdn.media.ccc.de/events/all_systems_go/2026/mp3/asg2026-394-eng-Proposal_for_TPM2_FIDO2_enrollment_in_systemd_mp3.mp3","url":"https://api.media.ccc.de/public/recordings/105572","event_url":"https://api.media.ccc.de/public/events/23b0213c-cfe6-5daf-a7f9-dd6bb7cafcec","conference_url":"https://api.media.ccc.de/public/conferences/asg2026"},{"length":1307,"mime_type":"video/mp4","language":"eng","filename":"asg2026-394-eng-Proposal_for_TPM2_FIDO2_enrollment_in_systemd_sd.mp4","state":"new","folder":"h264-sd","high_quality":false,"width":720,"height":576,"updated_at":"2026-09-30T12:40:13.517+02:00","label":"eng 576p","size":33,"recording_url":"https://cdn.media.ccc.de/events/all_systems_go/2026/h264-sd/asg2026-394-eng-Proposal_for_TPM2_FIDO2_enrollment_in_systemd_sd.mp4","url":"https://api.media.ccc.de/public/recordings/105573","event_url":"https://api.media.ccc.de/public/events/23b0213c-cfe6-5daf-a7f9-dd6bb7cafcec","conference_url":"https://api.media.ccc.de/public/conferences/asg2026"},{"length":1307,"mime_type":"video/webm;codecs=av01","language":"eng","filename":"asg2026-394-eng-Proposal_for_TPM2_FIDO2_enrollment_in_systemd_av1-sd.webm","state":"new","folder":"av1-sd","high_quality":false,"width":720,"height":576,"updated_at":"2026-09-30T12:41:51.370+02:00","label":"eng 576p","size":38,"recording_url":"https://cdn.media.ccc.de/events/all_systems_go/2026/av1-sd/asg2026-394-eng-Proposal_for_TPM2_FIDO2_enrollment_in_systemd_av1-sd.webm","url":"https://api.media.ccc.de/public/recordings/105574","event_url":"https://api.media.ccc.de/public/events/23b0213c-cfe6-5daf-a7f9-dd6bb7cafcec","conference_url":"https://api.media.ccc.de/public/conferences/asg2026"},{"length":1307,"mime_type":"video/webm","language":"eng","filename":"asg2026-394-eng-Proposal_for_TPM2_FIDO2_enrollment_in_systemd_webm-hd.webm","state":"new","folder":"webm-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2026-09-30T13:14:48.812+02:00","label":"eng 1080p","size":96,"recording_url":"https://cdn.media.ccc.de/events/all_systems_go/2026/webm-hd/asg2026-394-eng-Proposal_for_TPM2_FIDO2_enrollment_in_systemd_webm-hd.webm","url":"https://api.media.ccc.de/public/recordings/105588","event_url":"https://api.media.ccc.de/public/events/23b0213c-cfe6-5daf-a7f9-dd6bb7cafcec","conference_url":"https://api.media.ccc.de/public/conferences/asg2026"},{"length":1307,"mime_type":"video/webm","language":"eng","filename":"asg2026-394-eng-Proposal_for_TPM2_FIDO2_enrollment_in_systemd_webm-sd.webm","state":"new","folder":"webm-sd","high_quality":false,"width":720,"height":576,"updated_at":"2026-09-30T13:31:48.747+02:00","label":"eng 576p","size":44,"recording_url":"https://cdn.media.ccc.de/events/all_systems_go/2026/webm-sd/asg2026-394-eng-Proposal_for_TPM2_FIDO2_enrollment_in_systemd_webm-sd.webm","url":"https://api.media.ccc.de/public/recordings/105595","event_url":"https://api.media.ccc.de/public/events/23b0213c-cfe6-5daf-a7f9-dd6bb7cafcec","conference_url":"https://api.media.ccc.de/public/conferences/asg2026"}]}