I'm trying to set up my LUKS encryption to use 2FA with a password and a FIDO2 key with the following command:

systemd-cryptenroll --fido2-device=auto --fido2-with-user-verification=true /dev/my_disk_device

But I get the error FIDO2 tokens not supported on this build.

systemd-cryptenroll --version shows the following output:


The system is the current Kali linux. Is there any possibility to get an official package from the repos with FIDO2 support? Or do I have to compile my own version?

If I have to compile my own version, is there a trick to automatically update the package in Kali or Debian?


Kali updated the version of systemd to 250.2-3, which has FIDO2 support activated. Now the enrollment of the FIDO2 devices works. But I can't decrypt the partitions at boot.

To enable decryption at boot time you should add fido2-device=auto to the list of options in /etc/crypttab and update the initramfs.

But update-initramfs -u doesn't know this option: cryptsetup: WARNING: nvme0n1p3_crypt: ignoring unknown option 'fido2-device'

So the current answer is: How can I activate decryption with FIDO2 during boot?

Update 2: In the next version 250.3-1 will be the needed support in cryptsetup: https://manpages.debian.org/unstable/systemd/systemd-cryptsetup@.service.8.en.html


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.