From 4883ef8aae80b0c1e69047c83b3830b9675db8e3 Mon Sep 17 00:00:00 2001 From: Vitaly Kuznetsov Date: Fri, 27 Feb 2026 14:20:20 +0100 Subject: [PATCH] cryptsetup-tokens: Print tpm2-primary-alg: only when it is known When 'tpm2-primary-alg' is missing in LUKS JSON token, the output of 'cryptsetup luksDump' is always: tpm2-primary-alg: ecc because tpm2_parse_luks2_json() returns the default (TPM2_ALG_ECC). This can be misleading and wrong. Make tpm2_parse_luks2_json() return the reality and move the default to tpm2_unseal(). --- .../cryptsetup-tokens/cryptsetup-token-systemd-tpm2.c | 3 ++- src/shared/tpm2-util.c | 5 +++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-tpm2.c b/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-tpm2.c index 4b9fe111993..933d18e2fd7 100644 --- a/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-tpm2.c +++ b/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-tpm2.c @@ -230,7 +230,8 @@ _public_ void cryptsetup_token_dump( crypt_log(cd, "\ttpm2-pcr-bank: %s\n", strna(tpm2_hash_alg_to_string(pcr_bank))); crypt_log(cd, "\ttpm2-pubkey:" CRYPT_DUMP_LINE_SEP "%s\n", pubkey_str); crypt_log(cd, "\ttpm2-pubkey-pcrs: %s\n", strna(pubkey_pcrs_str)); - crypt_log(cd, "\ttpm2-primary-alg: %s\n", strna(tpm2_asym_alg_to_string(primary_alg))); + if (primary_alg != 0) + crypt_log(cd, "\ttpm2-primary-alg: %s\n", strna(tpm2_asym_alg_to_string(primary_alg))); crypt_log(cd, "\ttpm2-pin: %s\n", true_false(flags & TPM2_FLAGS_USE_PIN)); crypt_log(cd, "\ttpm2-pcrlock: %s\n", true_false(flags & TPM2_FLAGS_USE_PCRLOCK)); crypt_log(cd, "\ttpm2-salt: %s\n", true_false(iovec_is_set(&salt))); diff --git a/src/shared/tpm2-util.c b/src/shared/tpm2-util.c index 3b559bf84c2..f947e2fc48e 100644 --- a/src/shared/tpm2-util.c +++ b/src/shared/tpm2-util.c @@ -5625,8 +5625,9 @@ int tpm2_unseal(Tpm2Context *c, if (r < 0) return r; if (r == 0) { + /* ECC was the only supported algorithm in systemd < 250, use that as implied default, for compatibility */ if (primary_alg == 0) - return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "No SRK or primary algorithm provided."); + primary_alg = TPM2_ALG_ECC; TPM2B_PUBLIC template = { .size = sizeof(TPMT_PUBLIC), @@ -8589,7 +8590,7 @@ int tpm2_parse_luks2_json( _cleanup_(iovec_done) struct iovec pubkey = {}, salt = {}, srk = {}, pcrlock_nv = {}; uint32_t hash_pcr_mask = 0, pubkey_pcr_mask = 0; - uint16_t primary_alg = TPM2_ALG_ECC; /* ECC was the only supported algorithm in systemd < 250, use that as implied default, for compatibility */ + uint16_t primary_alg = 0; uint16_t pcr_bank = UINT16_MAX; /* default: pick automatically */ int r, keyslot = -1; TPM2Flags flags = 0; -- 2.47.3