From ed372199212faaebcec54e7c02dbef7ca926d7f0 Mon Sep 17 00:00:00 2001 From: Joel Mathew Thomas <90510078+joelmathewthomas@users.noreply.github.com> Date: Thu, 27 Jun 2024 04:18:57 +0530 Subject: [PATCH] Update README.md --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 0d88290..c70173f 100644 --- a/README.md +++ b/README.md @@ -541,7 +541,7 @@ Note that incorrect PIN entry when unlocking increments the TPM dictionary attac **Note**: Including PCR0 in the PCRs can cause the entry to become invalid after every firmware update. This happens because PCR0 reflects measurements of the firmware, and any update to the firmware will change these measurements, invalidating the TPM2 entry. If you prefer to avoid this issue, you might exclude PCR0 and use only PCR7 or other suitable PCRs. -Info , on all additional PCRs can be found [here](https://wiki.archlinux.org/title/Trusted_Platform_Module#Accessing_PCR_registers) +Info on all additional PCRs can be found [here](https://wiki.archlinux.org/title/Trusted_Platform_Module#Accessing_PCR_registers) If all is well, reboot , and you won't be prompted for a passphrase, unless secure boot is disabled or secure boot state has changed. @@ -552,7 +552,7 @@ Now if at some point later in time, our secure boot state has changed, the TPM w This can be done in a very short step and is less prone to error by running the following command: ``` -systemd-cryptenroll --wipe-slot=tpm2 /dev/ --tpm2-pcrs=0+7 +systemd-cryptenroll --wipe-slot=tpm2 /dev/ --tpm2-pcrs=7+11 ``` Or, if you prefer to do it manually, do the following: