FIDO2 tokens not supported on this build

[Timothy Allen]

I'm trying to test systemd-cryptenroll with FIDO2 keys in the new systemd version 248 on impish.

Running "systemd-cryptenroll --fido2-device=list" results in the message:

FIDO2 tokens not supported on this build.

Would it be possible to build systemd with FIDO support in time for the impish release?

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Joe Richey (joerichey)]

Note that this also means that TPM2 support also doesn't work with cryptsetup-enroll (for similar reasons to the FIDO2 support).

The fix in Debian (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=991129) also fixes TPM2 support. Once Ubuntu 21.10 picks up that change, we should be able to use TPM2 and FIDO2 keys with cryptsetup-enroll.

[Rebala Pratheek (pratheekrebala)]

I wanted to check if there is an expected date or tracking issue for picking up the change from Debian into Ubuntu 21.10? I am also trying to roll out LUKS decryption using TPM2 and running into this bug.

[Lukas Märdian (slyon)]

This has been enabled in Debian's systemd v250 via https://salsa.debian.org/systemd-team/systemd/-/commit/6b5e99f1d7f63c0c83007de9f98f7745f4a564f8

We're sticking with the more stable systemd v249 for Ubuntu Jammy LTS and we're already post feature freeze, so we cannot enable those new features (FIDO + TPM2 support).

This change will most probably land in Ubuntu 22.10 once we merge systemd v250+.

[Ari Pollak (aripollak)]

Looks like this has been released for 22.04: https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1969375