97. A machine may open its own root when its owner says so

Refines ADR-0039

Context

ADR-0039 sealed the root’s key to the TPM behind a PIN, and that remains the default. A server in a rack, a board on a bench and a machine that reboots after a power cut are all machines nobody stands at. A PIN on such a machine means it does not come back. Ubuntu’s TPM-backed encryption and BitLocker both open the disk with no PIN by default, because for those machines that is the trade people want. Their owners should be able to choose it here instead of turning encryption off.

Decision

--tpm-without-pin, and “unlocked by the TPM alone” in the setup, seal the key to PCR 7 with no PIN. The passphrase stays as the way back, and the default is unchanged.

• A new SlotAction::EnrolTpmWithoutPin { passphrase } runs systemd-cryptenroll --tpm2-pcrs=7 --tpm2-with-pin=no. Only the passphrase is passed, and only through PASSWORD. There is no NEWPIN to pass.
• The keeper accepts a TPM seal with no PIN only when the request says tpm_without_pin. A request that seals to the TPM and simply forgot the PIN is still refused. Silence is not consent to less security.
• The plan says what it means in words: “the key sealed to the TPM and the Secure Boot state with no PIN”. The setup says it too: whoever holds the machine reaches the login.

Consequences

• An unattended machine can be encrypted and still reboot by itself.
• A stolen machine with a TPM-only seal boots to its login prompt. The disk is protected against removal, not against someone holding the whole machine. That is the trade, and the screen that offers it says so.

Alternatives rejected

• Make TPM-only the default. A laptop is the machine most often stolen, and a PIN is what makes its TPM worthless to the thief.
• A blank PIN. systemd-cryptenroll treats an empty PIN as a PIN, and a prompt that accepts Enter is a prompt somebody has to be there to press Enter at.