Passwordless unlock

By default an encrypted ShedOS box asks for its passphrase at every boot. Once you trust the machine, you can bind the disk to its TPM2 — the small security chip on the motherboard — so it unlocks on its own when the machine boots its own kernel, with nothing to type.

This is the last step of the three-part story: disk encryption at install, then Secure Boot, then this. The order matters — the TPM hands over the disk key only against a boot chain it can verify, and it’s Secure Boot that makes the chain verifiable.

Before you start

Two things must already be true, and both take one command to check:

sudo shedman key --status          # the disk is encrypted (passphrase + recovery slots)
sudo shedman secureboot status     # Secure Boot is active and every image is signed

If Secure Boot isn’t on yet, do that page first — shedman tpm2 enroll checks and will refuse rather than set up an unlock the TPM could never honor.

Enabling it

sudo shedman tpm2 enroll

It adds a TPM keyslot to the encrypted disk, and to encrypted swap if you have it. Each volume has its own lock, so it asks for your current passphrase once per volume — on a standard install you type it twice, once for the root disk and once for swap. Reboot and the disk unlocks on its own; the passphrase prompt simply doesn’t appear.

Kernel and firmware updates don’t break it: the slot is bound to your Secure Boot signing key, not to a frozen snapshot of one particular boot, so any kernel this machine signs keeps unlocking.

The tradeoff

Passwordless unlock trades some security for convenience, and it’s worth knowing which.

Because the key is released only when this machine boots its own signed kernel, it protects your data at rest — a disk pulled from the machine, or the machine lost powered-off, stays encrypted and unreadable. What it does not protect is a machine that is already running, or an attacker with physical access who can roll the system back to an older signed kernel and let the TPM unlock it for them.

If that is in your threat model, add a PIN:

sudo shedman tpm2 enroll --with-pin

Now unlock needs the measured boot state and a short PIN at boot — shorter than the full passphrase, but enough to close the rollback gap. It is the same choice BitLocker offers between its TPM-only default and TPM-plus-PIN.

Managing it

sudo shedman tpm2 --status    # is TPM unlock enrolled, and on which disks
sudo shedman tpm2 re-enroll   # rotate the slot after a key or boot-chain change
sudo shedman tpm2 remove      # drop it; back to the passphrase at every boot

--status reports each encrypted volume, root and swap alike:

/dev/disk/by-uuid/4d033633-…: TPM2 unlock enrolled
/dev/disk/by-uuid/1b480829-…: TPM2 unlock enrolled

Removing the TPM slot leaves the passphrase and recovery key untouched — you simply go back to typing the passphrase at boot.

The whole flow at a glance

Starting from a fresh machine, the complete path to an encrypted disk that unlocks itself:

1. Install ShedOS with encryption on (the default) — set a passphrase, write down the recovery key.
2. Firmware setup — delete the Secure Boot keys to enter Setup Mode. Do not just switch Secure Boot on; an unenrolled machine is unsigned and the firmware would refuse to boot it.
3. sudo shedman secureboot enroll — mints your key, signs the boot chain, arms the firmware.
4. Reboot; shedman secureboot status should show Secure Boot active. If your firmware keeps a separate enable toggle, switch it on now.
5. sudo shedman tpm2 enroll — bind the disk to the TPM (add --with-pin if rollback is in your threat model).
6. Reboot. No prompt. Your passphrase and recovery key still work everywhere, forever.