path: root/templates/man1/systemd-cryptenroll.1.pot

# SOME DESCRIPTIVE TITLE
# Copyright (C) YEAR Free Software Foundation, Inc.
# This file is distributed under the same license as the PACKAGE package.
# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
#
#, fuzzy
msgid ""
msgstr ""
"Project-Id-Version: PACKAGE VERSION\n"
"POT-Creation-Date: 2024-03-01 17:10+0100\n"
"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: LANGUAGE <LL@li.org>\n"
"Language: \n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"

#. type: TH
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "SYSTEMD-CRYPTENROLL"
msgstr ""

#. type: TH
#: archlinux debian-unstable fedora-40 fedora-rawhide mageia-cauldron
#, no-wrap
msgid "systemd 255"
msgstr ""

#. type: TH
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "systemd-cryptenroll"
msgstr ""

#.  -----------------------------------------------------------------
#.  * MAIN CONTENT STARTS HERE *
#.  -----------------------------------------------------------------
#. type: SH
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "NAME"
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid ""
"systemd-cryptenroll - Enroll PKCS#11, FIDO2, TPM2 token/devices to LUKS2 "
"encrypted volumes"
msgstr ""

#. type: SH
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "SYNOPSIS"
msgstr ""

#. type: Plain text
#: archlinux debian-unstable fedora-40 fedora-rawhide mageia-cauldron
msgid "B<systemd-cryptenroll> [OPTIONS...] [DEVICE]"
msgstr ""

#. type: SH
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "DESCRIPTION"
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid ""
"B<systemd-cryptenroll> is a tool for enrolling hardware security tokens and "
"devices into a LUKS2 encrypted volume, which may then be used to unlock the "
"volume during boot\\&. Specifically, it supports tokens and credentials of "
"the following kind to be enrolled:"
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid ""
"PKCS#11 security tokens and smartcards that may carry an RSA key pair (e\\&."
"g\\&. various YubiKeys)"
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid ""
"FIDO2 security tokens that implement the \"hmac-secret\" extension (most "
"FIDO2 keys, including YubiKeys)"
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid "TPM2 security devices"
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid "Regular passphrases"
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid ""
"Recovery keys\\&. These are similar to regular passphrases, however are "
"randomly generated on the computer and thus generally have higher entropy "
"than user-chosen passphrases\\&. Their character set has been designed to "
"ensure they are easy to type in, while having high entropy\\&. They may also "
"be scanned off screen using QR codes\\&. Recovery keys may be used for "
"unlocking LUKS2 volumes wherever passphrases are accepted\\&. They are "
"intended to be used in combination with an enrolled hardware security token, "
"as a recovery option when the token is lost\\&."
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid ""
"In addition, the tool may be used to enumerate currently enrolled security "
"tokens and wipe a subset of them\\&. The latter may be combined with the "
"enrollment operation of a new security token, in order to update or replace "
"enrollments\\&."
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid ""
"The tool supports only LUKS2 volumes, as it stores token meta-information in "
"the LUKS2 JSON token area, which is not available in other encryption "
"formats\\&."
msgstr ""

#. type: SS
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "TPM2 PCRs and policies"
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid ""
"PCRs allow binding of the encryption of secrets to specific software "
"versions and system state, so that the enrolled key is only accessible (may "
"be \"unsealed\") if specific trusted software and/or configuration is "
"used\\&. Such bindings may be created with the option B<--tpm2-pcrs=> "
"described below\\&."
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid ""
"Secrets may also be bound indirectly: a signed policy for a state of some "
"combination of PCR values is provided, and the secret is bound to the public "
"part of the key used to sign this policy\\&. This means that the owner of a "
"key can generate a sequence of signed policies, for specific software "
"versions and system states, and the secret can be decrypted as long as the "
"machine state matches one of those policies\\&. For example, a vendor may "
"provide such a policy for each kernel+initrd update, allowing users to "
"encrypt secrets so that they can be decrypted when running any kernel+initrd "
"signed by the vendor\\&. Such bindings may be created with the options B<--"
"tpm2-public-key=>, B<--tpm2-public-key-pcrs=>, B<--tpm2-signature=> "
"described below\\&."
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid ""
"See \\m[blue]B<Linux TPM PCR Registry>\\m[]\\&\\s-2\\u[1]\\d\\s+2 for an "
"authoritative list of PCRs and how they are updated\\&. The table below "
"contains a quick reference, describing in particular the PCRs modified by "
"systemd\\&."
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid "B<Table\\ \\&1.\\ \\&Well-known PCR Definitions>"
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "PCR"
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "name"
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "Explanation"
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid ".T&"
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "l l l"
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "l l l."
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "0"
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "platform-code"
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "Core system firmware executable code; changes on firmware updates"
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "1"
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "platform-config"
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "Core system firmware data/host platform configuration; typically contains serial and model numbers, changes on basic hardware/CPU/RAM replacements"
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "2"
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "external-code"
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "Extended or pluggable executable code; includes option ROMs on pluggable hardware"
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "3"
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "external-config"
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "Extended or pluggable firmware data; includes information about pluggable hardware"
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "4"
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "boot-loader-code"
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "Boot loader and additional drivers, PE binaries invoked by the boot loader; changes on boot loader updates\\&. B<sd-stub>(7) measures system extension images read from the ESP here too (see B<systemd-sysext>(8))\\&."
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "5"
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "boot-loader-config"
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "GPT/Partition table; changes when the partitions are added, modified, or removed"
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "7"
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "secure-boot-policy"
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "Secure Boot state; changes when UEFI SecureBoot mode is enabled/disabled, or firmware certificates (PK, KEK, db, dbx, \\&...) changes\\&."
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "9"
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "kernel-initrd"
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "The Linux kernel measures all initrds it receives into this PCR\\&."
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "10"
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "ima"
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "The IMA project measures its runtime state into this PCR\\&."
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "11"
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "kernel-boot"
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "B<systemd-stub>(7) measures the ELF kernel image, embedded initrd and other payload of the PE image it is placed in into this PCR\\&. B<systemd-pcrphase.service>(8) measures boot phase strings into this PCR at various milestones of the boot process\\&."
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "12"
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "kernel-config"
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "B<systemd-boot>(7) measures the kernel command line into this PCR\\&. B<systemd-stub>(7) measures any manually specified kernel command line (i\\&.e\\&. a kernel command line that overrides the one embedded in the unified PE image) and loaded credentials into this PCR\\&."
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "13"
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "sysexts"
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "B<systemd-stub>(7) measures any B<systemd-sysext>(8) images it passes to the booted kernel into this PCR\\&."
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "14"
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "shim-policy"
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "The shim project measures its \"MOK\" certificates and hashes into this PCR\\&."
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "15"
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "system-identity"
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "B<systemd-cryptsetup>(8) optionally measures the volume key of activated LUKS volumes into this PCR\\&. B<systemd-pcrmachine.service>(8) measures the B<machine-id>(5) into this PCR\\&. B<systemd-pcrfs@.service>(8) measures mount points, file system UUIDs, labels, partition UUIDs of the root and /var/ filesystems into this PCR\\&."
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "16"
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "debug"
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "Debug"
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "23"
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "application-support"
msgstr ""

#. type: tbl table
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "Application Support"
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid ""
"In general, encrypted volumes would be bound to some combination of PCRs 7, "
"11, and 14 (if shim/MOK is used)\\&. In order to allow firmware and OS "
"version updates, it is typically not advisable to use PCRs such as 0 and 2, "
"since the program code they cover should already be covered indirectly "
"through the certificates measured into PCR 7\\&. Validation through "
"certificates hashes is typically preferable over validation through direct "
"measurements as it is less brittle in context of OS/firmware updates: the "
"measurements will change on every update, but signatures should remain "
"unchanged\\&. See the \\m[blue]B<Linux TPM PCR "
"Registry>\\m[]\\&\\s-2\\u[1]\\d\\s+2 for more discussion\\&."
msgstr ""

#. type: SH
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "LIMITATIONS"
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid ""
"Note that currently when enrolling a new key of one of the five supported "
"types listed above, it is required to first provide a passphrase, a recovery "
"key or a FIDO2 token\\&. It\\*(Aqs currently not supported to unlock a "
"device with a TPM2/PKCS#11 key in order to enroll a new TPM2/PKCS#11 key\\&. "
"Thus, if in future key roll-over is desired it\\*(Aqs generally recommended "
"to ensure a passphrase, a recovery key or a FIDO2 token is always "
"enrolled\\&."
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid ""
"Also note that support for enrolling multiple FIDO2 tokens is currently "
"limited\\&. When multiple FIDO2 tokens are enrolled, B<systemd-cryptseup> "
"will perform pre-flight requests to attempt to identify which of the "
"enrolled tokens are currently plugged in\\&. However, this is not possible "
"for FIDO2 tokens with user verification (UV, usually via biometrics), in "
"which case it will fall back to attempting each enrolled token one by "
"one\\&. This will result in multiple prompts for PIN and user "
"verification\\&. This limitation does not apply to PKCS#11 tokens\\&."
msgstr ""

#. type: SH
#: archlinux debian-unstable fedora-40 fedora-rawhide mageia-cauldron
#, no-wrap
msgid "COMPATIBILITY"
msgstr ""

#. type: Plain text
#: archlinux debian-unstable fedora-40 fedora-rawhide mageia-cauldron
msgid ""
"Security technology both in systemd and in the general industry constantly "
"evolves\\&. In order to provide best security guarantees, the way TPM2, "
"FIDO2, PKCS#11 devices are enrolled is regularly updated in newer versions "
"of systemd\\&. Whenever this happens the following compatibility guarantees "
"are given:"
msgstr ""

#. type: Plain text
#: archlinux debian-unstable fedora-40 fedora-rawhide mageia-cauldron
msgid ""
"Old enrollments continue to be supported and may be unlocked with newer "
"versions of B<systemd-cryptsetup@.service>(8)\\&."
msgstr ""

#. type: Plain text
#: archlinux debian-unstable fedora-40 fedora-rawhide mageia-cauldron
msgid ""
"The opposite is not guaranteed however: it might not be possible to unlock "
"volumes with enrollments done with a newer version of B<systemd-cryptenroll> "
"with an older version of B<systemd-cryptsetup>\\&."
msgstr ""

#. type: Plain text
#: archlinux debian-unstable fedora-40 fedora-rawhide mageia-cauldron
msgid ""
"That said, it is generally recommended to use matching versions of B<systemd-"
"cryptenroll> and B<systemd-cryptsetup>, since this is best tested and "
"supported\\&."
msgstr ""

#. type: Plain text
#: archlinux debian-unstable fedora-40 fedora-rawhide mageia-cauldron
msgid ""
"It might be advisable to re-enroll existing enrollments to take benefit of "
"newer security features, as they are added to systemd\\&."
msgstr ""

#. type: SH
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "OPTIONS"
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid "The following options are understood:"
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid "B<--password>"
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid ""
"Enroll a regular password/passphrase\\&. This command is mostly equivalent "
"to B<cryptsetup luksAddKey>, however may be combined with B<--wipe-slot=> in "
"one call, see below\\&."
msgstr ""

#. type: Plain text
#: archlinux debian-unstable fedora-40 fedora-rawhide mageia-cauldron
msgid "Added in version 248\\&."
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid "B<--recovery-key>"
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid ""
"Enroll a recovery key\\&. Recovery keys are mostly identical to passphrases, "
"but are computer-generated instead of being chosen by a human, and thus have "
"a guaranteed high entropy\\&. The key uses a character set that is easy to "
"type in, and may be scanned off screen via a QR code\\&."
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid "B<--unlock-key-file=>I<PATH>"
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid ""
"Use a file instead of a password/passphrase read from stdin to unlock the "
"volume\\&. Expects the PATH to the file containing your key to unlock the "
"volume\\&. Currently there is nothing like B<--key-file-offset=> or B<--key-"
"file-size=> so this file has to only contain the full key\\&."
msgstr ""

#. type: Plain text
#: archlinux debian-unstable fedora-40 fedora-rawhide mageia-cauldron
msgid "Added in version 252\\&."
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid "B<--unlock-fido2-device=>I<PATH>"
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid ""
"Use a FIDO2 device instead of a password/passphrase read from stdin to "
"unlock the volume\\&. Expects a hidraw device referring to the FIDO2 device "
"(e\\&.g\\&.  /dev/hidraw1)\\&. Alternatively the special value \"auto\" may "
"be specified, in order to automatically determine the device node of a "
"currently plugged in security token (of which there must be exactly one)\\&. "
"This automatic discovery is unsupported if B<--fido2-device=> option is also "
"specified\\&."
msgstr ""

#. type: Plain text
#: archlinux debian-unstable fedora-40 fedora-rawhide mageia-cauldron
msgid "Added in version 253\\&."
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid "B<--pkcs11-token-uri=>I<URI>"
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid ""
"Enroll a PKCS#11 security token or smartcard (e\\&.g\\&. a YubiKey)\\&. "
"Expects a PKCS#11 smartcard URI referring to the token\\&. Alternatively the "
"special value \"auto\" may be specified, in order to automatically determine "
"the URI of a currently plugged in security token (of which there must be "
"exactly one)\\&. The special value \"list\" may be used to enumerate all "
"suitable PKCS#11 tokens currently plugged in\\&. The security token must "
"contain an RSA key pair which is used to encrypt the randomly generated key "
"that is used to unlock the LUKS2 volume\\&. The encrypted key is then stored "
"in the LUKS2 JSON token header area\\&."
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid ""
"In order to unlock a LUKS2 volume with an enrolled PKCS#11 security token, "
"specify the B<pkcs11-uri=> option in the respective /etc/crypttab line:"
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "myvolume /dev/sda1 - pkcs11-uri=auto\n"
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid ""
"See B<crypttab>(5)  for a more comprehensive example of a B<systemd-"
"cryptenroll> invocation and its matching /etc/crypttab line\\&."
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid "B<--fido2-credential-algorithm=>I<STRING>"
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid ""
"Specify COSE algorithm used in credential generation\\&. The default value "
"is \"es256\"\\&. Supported values are \"es256\", \"rs256\" and \"eddsa\"\\&."
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid ""
"\"es256\" denotes ECDSA over NIST P-256 with SHA-256\\&.  \"rs256\" denotes "
"2048-bit RSA with PKCS#1\\&.5 padding and SHA-256\\&.  \"eddsa\" denotes "
"EDDSA over Curve25519 with SHA-512\\&."
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid "Note that your authenticator may not support some algorithms\\&."
msgstr ""

#. type: Plain text
#: archlinux debian-unstable fedora-40 fedora-rawhide mageia-cauldron
msgid "Added in version 251\\&."
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid "B<--fido2-device=>I<PATH>"
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid ""
"Enroll a FIDO2 security token that implements the \"hmac-secret\" extension "
"(e\\&.g\\&. a YubiKey)\\&. Expects a hidraw device referring to the FIDO2 "
"device (e\\&.g\\&.  /dev/hidraw1)\\&. Alternatively the special value "
"\"auto\" may be specified, in order to automatically determine the device "
"node of a currently plugged in security token (of which there must be "
"exactly one)\\&. This automatic discovery is unsupported if B<--unlock-fido2-"
"device=> option is also specified\\&. The special value \"list\" may be used "
"to enumerate all suitable FIDO2 tokens currently plugged in\\&. Note that "
"many hardware security tokens that implement FIDO2 also implement the older "
"PKCS#11 standard\\&. Typically FIDO2 is preferable, given it\\*(Aqs simpler "
"to use and more modern\\&."
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid ""
"In order to unlock a LUKS2 volume with an enrolled FIDO2 security token, "
"specify the B<fido2-device=> option in the respective /etc/crypttab line:"
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "myvolume /dev/sda1 - fido2-device=auto\n"
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid "B<--fido2-with-client-pin=>I<BOOL>"
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid ""
"When enrolling a FIDO2 security token, controls whether to require the user "
"to enter a PIN when unlocking the volume (the FIDO2 \"clientPin\" "
"feature)\\&. Defaults to \"yes\"\\&. (Note: this setting is without effect "
"if the security token does not support the \"clientPin\" feature at all, or "
"does not allow enabling or disabling it\\&.)"
msgstr ""

#. type: Plain text
#: archlinux debian-unstable fedora-40 fedora-rawhide mageia-cauldron
msgid "Added in version 249\\&."
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid "B<--fido2-with-user-presence=>I<BOOL>"
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid ""
"When enrolling a FIDO2 security token, controls whether to require the user "
"to verify presence (tap the token, the FIDO2 \"up\" feature) when unlocking "
"the volume\\&. Defaults to \"yes\"\\&. (Note: this setting is without effect "
"if the security token does not support the \"up\" feature at all, or does "
"not allow enabling or disabling it\\&.)"
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid "B<--fido2-with-user-verification=>I<BOOL>"
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid ""
"When enrolling a FIDO2 security token, controls whether to require user "
"verification when unlocking the volume (the FIDO2 \"uv\" feature)\\&. "
"Defaults to \"no\"\\&. (Note: this setting is without effect if the security "
"token does not support the \"uv\" feature at all, or does not allow enabling "
"or disabling it\\&.)"
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid "B<--tpm2-device=>I<PATH>"
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid ""
"Enroll a TPM2 security chip\\&. Expects a device node path referring to the "
"TPM2 chip (e\\&.g\\&.  /dev/tpmrm0)\\&. Alternatively the special value "
"\"auto\" may be specified, in order to automatically determine the device "
"node of a currently discovered TPM2 device (of which there must be exactly "
"one)\\&. The special value \"list\" may be used to enumerate all suitable "
"TPM2 devices currently discovered\\&."
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid ""
"In order to unlock a LUKS2 volume with an enrolled TPM2 security chip, "
"specify the B<tpm2-device=> option in the respective /etc/crypttab line:"
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "myvolume /dev/sda1 - tpm2-device=auto\n"
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid ""
"Use B<--tpm2-pcrs=> (see below) to configure which TPM2 PCR indexes to bind "
"the enrollment to\\&."
msgstr ""

#. type: Plain text
#: archlinux debian-unstable fedora-40 fedora-rawhide mageia-cauldron
msgid "B<--tpm2-device-key=>I<PATH>"
msgstr ""

#. type: Plain text
#: archlinux debian-unstable fedora-40 fedora-rawhide mageia-cauldron
msgid ""
"Enroll a TPM2 security chip using its public key\\&. Expects a path "
"referring to the TPM2 public key in TPM2B_PUBLIC format\\&. This cannot be "
"used with B<--tpm2-device=>, as it performs the same operation, but without "
"connecting to the TPM2 security chip; instead the enrollment is calculated "
"using the provided TPM2 key\\&. This is useful in situations where the TPM2 "
"security chip is not available at the time of enrollment\\&."
msgstr ""

#. type: Plain text
#: archlinux debian-unstable fedora-40 fedora-rawhide mageia-cauldron
msgid ""
"The key, in most cases, should be the Storage Root Key (SRK) from a local "
"TPM2 security chip\\&. If a key from a different handle (not the SRK) is "
"used, you must specify its handle index using B<--tpm2-seal-key-handle=>\\&."
msgstr ""

#. type: Plain text
#: archlinux debian-unstable fedora-40 fedora-rawhide mageia-cauldron
msgid ""
"The B<systemd-tpm2-setup.service>(8)  service writes the SRK to /run/systemd/"
"tpm2-srk-public-key\\&.tpm2b_public automatically during boot, in the "
"correct format\\&."
msgstr ""

#. type: Plain text
#: archlinux debian-unstable fedora-40 fedora-rawhide mageia-cauldron
msgid ""
"Alternatively, you may use B<systemd-analyze srk> to retrieve the SRK from "
"the TPM2 security chip explicitly\\&. See B<systemd-analyze>(1)  for "
"details\\&. Example:"
msgstr ""

#. type: Plain text
#: archlinux debian-unstable fedora-40 fedora-rawhide mageia-cauldron
#, no-wrap
msgid "systemd-analyze srk E<gt> srk\\&.tpm2b_public\n"
msgstr ""

#. type: Plain text
#: archlinux debian-unstable fedora-40 fedora-rawhide mageia-cauldron
msgid "Added in version 255\\&."
msgstr ""

#. type: Plain text
#: archlinux debian-unstable fedora-40 fedora-rawhide mageia-cauldron
msgid "B<--tpm2-seal-key-handle=>I<HANDLE>"
msgstr ""

#. type: Plain text
#: archlinux debian-unstable fedora-40 fedora-rawhide mageia-cauldron
msgid ""
"Configures which parent key to use for sealing, using the TPM handle (index) "
"of the key\\&. This is used to \"seal\" (encrypt) a secret and must be used "
"later to \"unseal\" (decrypt) the secret\\&. Expects a hexadecimal 32bit "
"integer, optionally prefixed with \"0x\"\\&. Allowable values are any handle "
"index in the persistent (\"0x81000000\"-\"0x81ffffff\") or transient "
"(\"0x80000000\"-\"0x80ffffff\") ranges\\&. Since transient handles are lost "
"after a TPM reset, and may be flushed during TPM context switching, they "
"should not be used except for very specific use cases, e\\&.g\\&. testing\\&."
msgstr ""

#. type: Plain text
#: archlinux debian-unstable fedora-40 fedora-rawhide mageia-cauldron
msgid ""
"The default is the Storage Root Key (SRK) handle index \"0x81000001\"\\&. A "
"value of 0 will use the default\\&. For the SRK handle, a new key will be "
"created and stored in the TPM if one does not already exist; for any other "
"handle, the key must already exist in the TPM at the specified handle "
"index\\&."
msgstr ""

#. type: Plain text
#: archlinux debian-unstable fedora-40 fedora-rawhide mageia-cauldron
msgid "This should not be changed unless you know what you are doing\\&."
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid "B<--tpm2-pcrs=> [PCR...]"
msgstr ""

#. type: Plain text
#: archlinux debian-unstable fedora-40 fedora-rawhide mageia-cauldron
msgid ""
"Configures the TPM2 PCRs (Platform Configuration Registers) to bind to when "
"enrollment is requested via B<--tpm2-device=>\\&. Takes a list of PCR "
"entries, where each entry starts with a name or numeric index in the range "
"0\\&...23, optionally followed by \":\" and a hash algorithm name "
"(specifying the PCR bank), optionally followed by \"=\" and a hash digest "
"value\\&. Multiple PCR entries are separated by \"+\"\\&. If not specified, "
"the default is to use PCR 7 only\\&. If an empty string is specified, binds "
"the enrollment to no PCRs at all\\&. See the table above for a list of "
"available PCRs\\&."
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid ""
"Example: B<--tpm2-pcrs=boot-loader-code+platform-config+boot-loader-config> "
"specifies that PCR registers 4, 1, and 5 should be used\\&."
msgstr ""

#. type: Plain text
#: archlinux debian-unstable fedora-40 fedora-rawhide mageia-cauldron
msgid ""
"Example: B<--tpm2-pcrs=7:sha256> specifies that PCR register 7 from the "
"SHA256 bank should be used\\&."
msgstr ""

#. type: Plain text
#: archlinux debian-unstable fedora-40 fedora-rawhide mageia-cauldron
msgid ""
"Example: B<--tpm2-pcrs=4:sha1=3a3f780f11a4b49969fcaa80cd6e3957c33b2275> "
"specifies that PCR register 4 from the SHA1 bank should be used, and a hash "
"digest value of 3a3f780f11a4b49969fcaa80cd6e3957c33b2275 will be used "
"instead of reading the current PCR value\\&."
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid "B<--tpm2-with-pin=>I<BOOL>"
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid ""
"When enrolling a TPM2 device, controls whether to require the user to enter "
"a PIN when unlocking the volume in addition to PCR binding, based on TPM2 "
"policy authentication\\&. Defaults to \"no\"\\&. Despite being called PIN, "
"any character can be used, not just numbers\\&."
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid ""
"Note that incorrect PIN entry when unlocking increments the TPM dictionary "
"attack lockout mechanism, and may lock out users for a prolonged time, "
"depending on its configuration\\&. The lockout mechanism is a global "
"property of the TPM, B<systemd-cryptenroll> does not control or configure "
"the lockout mechanism\\&. You may use tpm2-tss tools to inspect or configure "
"the dictionary attack lockout, with B<tpm2_getcap>(1)  and "
"B<tpm2_dictionarylockout>(1)  commands, respectively\\&."
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid ""
"B<--tpm2-public-key=> [PATH], B<--tpm2-public-key-pcrs=> [PCR...], B<--tpm2-"
"signature=> [PATH]"
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid ""
"Configures a TPM2 signed PCR policy to bind encryption to\\&. The B<--tpm2-"
"public-key=> option accepts a path to a PEM encoded RSA public key, to bind "
"the encryption to\\&. If this is not specified explicitly, but a file tpm2-"
"pcr-public-key\\&.pem exists in one of the directories /etc/systemd/, /run/"
"systemd/, /usr/lib/systemd/ (searched in this order), it is automatically "
"used\\&. The B<--tpm2-public-key-pcrs=> option takes a list of TPM2 PCR "
"indexes to bind to (same syntax as B<--tpm2-pcrs=> described above)\\&. If "
"not specified defaults to 11 (i\\&.e\\&. this binds the policy to any "
"unified kernel image for which a PCR signature can be provided)\\&."
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid ""
"Note the difference between B<--tpm2-pcrs=> and B<--tpm2-public-key-pcrs=>: "
"the former binds decryption to the current, specific PCR values; the latter "
"binds decryption to any set of PCR values for which a signature by the "
"specified public key can be provided\\&. The latter is hence more useful in "
"scenarios where software updates shell be possible without losing access to "
"all previously encrypted LUKS2 volumes\\&. Like with B<--tpm2-pcrs=>, names "
"defined in the table above can also be used to specify the registers, for "
"instance B<--tpm2-public-key-pcrs=boot-loader-code+system-identity>\\&."
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid ""
"The B<--tpm2-signature=> option takes a path to a TPM2 PCR signature file as "
"generated by the B<systemd-measure>(1)  tool\\&. If this is not specified "
"explicitly, a suitable signature file tpm2-pcr-signature\\&.json is searched "
"for in /etc/systemd/, /run/systemd/, /usr/lib/systemd/ (in this order) and "
"used\\&. If a signature file is specified or found it is used to verify if "
"the volume can be unlocked with it given the current PCR state, before the "
"new slot is written to disk\\&. This is intended as safety net to ensure "
"that access to a volume is not lost if a public key is enrolled for which no "
"valid signature for the current PCR state is available\\&. If the supplied "
"signature does not unlock the current PCR state and public key combination, "
"no slot is enrolled and the operation will fail\\&. If no signature file is "
"specified or found no such safety verification is done\\&."
msgstr ""

#. type: Plain text
#: archlinux debian-unstable fedora-40 fedora-rawhide mageia-cauldron
msgid "B<--tpm2-pcrlock=> [PATH]"
msgstr ""

#. type: Plain text
#: archlinux debian-unstable fedora-40 fedora-rawhide mageia-cauldron
msgid ""
"Configures a TPM2 pcrlock policy to bind encryption to\\&. Expects a path to "
"a pcrlock policy file as generated by the B<systemd-pcrlock>(1)  tool\\&. If "
"a TPM2 device is enrolled and this option is not used but a file pcrlock\\&."
"json is found in /run/systemd/ or /var/lib/systemd/ it is automatically "
"used\\&. Assign an empty string to turn this behaviour off\\&."
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid "B<--wipe-slot=> [SLOT...]"
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid ""
"Wipes one or more LUKS2 key slots\\&. Takes a comma separated list of "
"numeric slot indexes, or the special strings \"all\" (for wiping all key "
"slots), \"empty\" (for wiping all key slots that are unlocked by an empty "
"passphrase), \"password\" (for wiping all key slots that are unlocked by a "
"traditional passphrase), \"recovery\" (for wiping all key slots that are "
"unlocked by a recovery key), \"pkcs11\" (for wiping all key slots that are "
"unlocked by a PKCS#11 token), \"fido2\" (for wiping all key slots that are "
"unlocked by a FIDO2 token), \"tpm2\" (for wiping all key slots that are "
"unlocked by a TPM2 chip), or any combination of these strings or numeric "
"indexes, in which case all slots matching either are wiped\\&. As safety "
"precaution an operation that wipes all slots without exception (so that the "
"volume cannot be unlocked at all anymore, unless the volume key is known) is "
"refused\\&."
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid ""
"This switch may be used alone, in which case only the requested wipe "
"operation is executed\\&. It may also be used in combination with any of the "
"enrollment options listed above, in which case the enrollment is completed "
"first, and only when successful the wipe operation executed \\(em and the "
"newly added slot is always excluded from the wiping\\&. Combining enrollment "
"and slot wiping may thus be used to update existing enrollments:"
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "systemd-cryptenroll /dev/sda1 --wipe-slot=tpm2 --tpm2-device=auto\n"
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid ""
"The above command will enroll the TPM2 chip, and then wipe all previously "
"created TPM2 enrollments on the LUKS2 volume, leaving only the newly created "
"one\\&. Combining wiping and enrollment may also be used to replace "
"enrollments of different types, for example for changing from a PKCS#11 "
"enrollment to a FIDO2 one:"
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "systemd-cryptenroll /dev/sda1 --wipe-slot=pkcs11 --fido2-device=auto\n"
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid "Or for replacing an enrolled empty password by TPM2:"
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "systemd-cryptenroll /dev/sda1 --wipe-slot=empty --tpm2-device=auto\n"
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid "B<-h>, B<--help>"
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid "Print a short help text and exit\\&."
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid "B<--version>"
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid "Print a short version string and exit\\&."
msgstr ""

#. type: SH
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "EXIT STATUS"
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid "On success, 0 is returned, a non-zero failure code otherwise\\&."
msgstr ""

#. type: SH
#: archlinux debian-unstable fedora-40 fedora-rawhide mageia-cauldron
#, no-wrap
msgid "EXAMPLES"
msgstr ""

#. type: Plain text
#: archlinux debian-unstable fedora-40 fedora-rawhide mageia-cauldron
msgid ""
"B<crypttab>(5)  and B<systemd-measure>(1)  contain various examples "
"employing B<systemd-cryptenroll>\\&."
msgstr ""

#. type: SH
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "SEE ALSO"
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid ""
"B<systemd>(1), B<systemd-cryptsetup@.service>(8), B<crypttab>(5), "
"B<cryptsetup>(8), B<systemd-measure>(1)"
msgstr ""

#. type: SH
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid "NOTES"
msgstr ""

#. type: IP
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
#, no-wrap
msgid " 1."
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid "Linux TPM PCR Registry"
msgstr ""

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron
msgid "\\%https://uapi-group.org/specifications/specs/linux_tpm_pcr_registry/"
msgstr ""

#. type: TH
#: debian-bookworm
#, no-wrap
msgid "systemd 254"
msgstr ""

#. type: Plain text
#: debian-bookworm
msgid "B<systemd-cryptenroll >B<[OPTIONS...]>B< >B<[DEVICE]>"
msgstr ""

#. type: Plain text
#: debian-bookworm
msgid ""
"Configures the TPM2 PCRs (Platform Configuration Registers) to bind to when "
"enrollment is requested via B<--tpm2-device=>\\&. Takes a list of PCR names "
"or numeric indices in the range 0\\&...23\\&. Multiple PCR indexes are "
"separated by \"+\"\\&. If not specified, the default is to use PCR 7 "
"only\\&. If an empty string is specified, binds the enrollment to no PCRs at "
"all\\&. See the table above for a list of available PCRs\\&."
msgstr ""