I just finished setting up a LUKS encrypted system that is unlocked using a FIDO2 hardware token following this blog post. However, at home I usually leave the hardware token plugged in and I only remove it when traveling. So if someone were to steal the laptop together with the plugged-in hardware token they could easily boot the laptop and decrypt the disk.

To remedy this I'd like to use 2FA with both a password and the hardware token, but so far I only found solutions using a password + HMAC-SHA1 by using the password as the challenge and storing the generated hash as the actual password in LUKS, so this does not generalize to FIDO2. Is there a way to get 2FA working with FIDO2, too?


Systemd has a module for that since version 248. It's called systemd-cryptenroll. Depending on the capabilities of your FIDO2 stick multiple options are available for 2FA:

  • --fido2-with-user-presence=true configures the system so that you need to touch the FIDO2 stick.
  • --fido2-with-client-pin=true configures the system so that you need the FIDO2 stick and enter the PIN.
  • --fido2-with-user-verification=true configures the system so that you need the FIDO2 stick and authenticate to the system.

An example call would be systemd-cryptenroll --fido2-device=auto --fido2-with-user-verification=true /dev/sda3

But you should experiment with a spare USB drive or an image. Make sure everything works as expected before you enroll the FIDO2 key to your real devices.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.