/usr/bin/systemd-cryptenroll

> systemd-cryptenroll [OPTION…] [BLOCK-DEVICE]

Enroll a security token or authentication credential to a LUKS volume.

Options:
  -h --help                                  Show this help
     --version                               Show package version
     --no-pager                              Do not start a pager
     --list-devices                          List candidate block devices to operate on
     --wipe-slot=SLOT1,SLOT2,…               Wipe specified slots
     --firstboot                             Interactively enroll a credential (first-boot wizard)
     --prompt-suppress=TYPE1,TYPE2,…         Skip the --firstboot wizard if a slot of any listed
                                             type exists
     --chrome=BOOL                           In first-boot mode: if false don't show colour bar at
                                             top and bottom of terminal
     --mute-console=BOOL                     In first-boot mode, tell kernel/PID 1 to not write to
                                             the console while running

Unlocking:
     --unlock-empty                          Use an empty password to unlock the volume
     --unlock-key-file=PATH                  Use a file to unlock the volume
     --unlock-fido2-device=PATH              Use a FIDO2 device to unlock the volume
     --unlock-tpm2-device=PATH               Use a TPM2 device to unlock the volume
     --unlock-headless                       Try the 'headless' unlock mechanisms in turn

Simple Enrollment:
     --password                              Enroll a user-supplied password
     --recovery-key                          Enroll a recovery key

PKCS#11 Enrollment:
     --pkcs11-token-uri=URI|auto|list        Enroll a PKCS#11 security token or list them

FIDO2 Enrollment:
     --fido2-device=PATH|auto|list           Enroll a FIDO2-HMAC security token or list them
     --fido2-salt-file=PATH                  Use salt from a file instead of generating one
     --fido2-parameters-in-header=BOOL       Whether to store FIDO2 parameters in the LUKS2 header
     --fido2-credential-algorithm=STRING     Specify COSE algorithm for FIDO2 credential
     --fido2-with-client-pin=BOOL            Whether to require entering a PIN to unlock the volume
     --fido2-with-user-presence=BOOL         Whether to require user presence to unlock the volume
     --fido2-with-user-verification=BOOL     Whether to require user verification to unlock the
                                             volume

TPM2 Enrollment:
     --tpm2-device=PATH|auto|list            Enroll a TPM2 device or list them
     --tpm2-device-key=PATH                  Enroll a TPM2 device using its public key
     --tpm2-seal-key-handle=HANDLE           Specify handle of key to use for sealing
     --tpm2-pcrs=PCR1+PCR2+PCR3+…            Specify TPM2 PCRs to seal against
     --tpm2-public-key=PATH                  Enroll signed TPM2 PCR policy against PEM public key
     --tpm2-public-key-policyref=STRING      Enroll signed TPM2 PCR policy with the specified policy
                                             reference
     --tpm2-public-key-pcrs=PCR1+PCR2+PCR3+… Enroll signed TPM2 PCR policy for specified TPM2 PCRs
     --tpm2-signature=PATH                   Validate public key enrollment works with JSON
                                             signature file
     --tpm2-pcrlock=PATH                     Specify pcrlock policy to lock against
     --tpm2-with-pin=BOOL|direct             Whether to require entering a PIN to unlock the volume.
                                             Takes a boolean or the special value "direct". When
                                             enabled (true), Argon2id is used for PIN hardening.
                                             When "direct", the PIN is used directly without
                                             Argon2id (compatible with older systemd versions)
     --tpm2-argon2id-memory=BYTES            Argon2id memory cost in bytes (default: 64M)
     --tpm2-argon2id-iterations=NUM          Argon2id iteration count (default: 8)
     --tpm2-argon2id-parallelism=NUM         Argon2id parallelism/lane count (default: 4)
     --tpm2-argon2id-iter-time=TIME          Target Argon2id benchmark time in seconds (default: 2s)

See the systemd-cryptenroll(1) man page for details.