A pluggable framework for automated decryption of data and unlocking of LUKS volumes using pins like Tang, TPM2, and PKCS#11.
Clevis is an automated decryption framework that provides pluggable, policy-based decryption for data and LUKS-encrypted volumes. It solves the problem of manual decryption by using modular plugins (pins) like Tang, TPM2, and PKCS#11 to handle decryption automatically during boot or data access.
System administrators and security engineers managing encrypted Linux systems, especially those needing automated unlocking of LUKS volumes or secure, policy-based data decryption.
Developers choose Clevis for its extensible pin system, seamless integration with Linux disk encryption (LUKS), and support for hardware-backed security (TPM2, HSMs) without requiring proprietary solutions.
Automated Encryption Framework
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Clevis uses pluggable pins like Tang, TPM2, and PKCS#11 to support diverse decryption methods, allowing flexible, policy-based automation as shown in encryption commands with configurable JSON.
Direct support for TPM2 chips and PKCS#11-compatible HSMs enables hardware-backed key storage without escrow, enhancing security for sensitive deployments.
Integrates with boot loaders like Dracut and desktop environments via UDisks2 for automatic volume decryption during boot or session startup, reducing manual intervention.
Implements Shamir Secret Sharing for threshold-based decryption, enabling complex access policies as demonstrated in SSS pin examples with multiple child pins.
Configuration requires detailed URI specifications, manual module paths, and systemd socket setup, making it error-prone and time-consuming, as evidenced by the lengthy README section.
Tang-based decryption relies on network-accessible servers, which can fail and require additional kernel arguments (e.g., rd.neednet=1) for proper initramfs integration.
PKCS#11 pin only supports RSA mechanisms, and the README explicitly warns that RSA-PKCS is insecure for production, restricting secure options for HSM integration.