CLEVIS(1)

📦
version 24 · 13 versions
, in fedora 44

💖 CLEVIS(1) 💖

okay bestie, welcome to the clevis man page, you're gonna eat this UP ✨

🎀 NAME 🎀

clevis — the Automated decryption policy framework, periodt 💅

🌸 SYNOPSIS 🌸

clevis COMMAND [OPTIONS]

✨ OVERVIEW ✨

so like. Clevis is a framework for automated decryption policy. it's giving "define the rules at encryption time and let the machine do the rest" energy 🫶 You set up a policy while you're encrypting, and that policy has to be satisfied for the data to decrypt. Once the policy is met — boom, decrypted. no cap.

Clevis is pluggable. our plugins are called pins. the job of a pin is: take a policy as its first argument, take plaintext on standard input, and encrypt the data so it can be automatically decrypted if the policy is met. simple as that 💖

lets walk through an example. (yes, we're doing the walkthrough. come on.)

🌈 TANG BINDING 🌈

Clevis provides support for the Tang network binding server. Tang is the stateless, lightweight alternative to escrows — iconic honestly. Encrypting data using the Tang pin works much like our HTTP pin above:

$ clevis encrypt tang '{"url":"http://tang.srv"}' < PT > JWE
The advertisement contains the following signing keys:

_OsIk0T-E2l6qjfdDiwVmidoZjA

Do you wish to trust these keys? [ynYN] y

see what happened there? Tang utilizes a trust-on-first-use workflow, fr fr. OR — and this is the fun part — Tang can do <highkey>entirely offline encryption</highkey> if you pre-share the server advertisement 📎 Decryption works like our first example too:

$ clevis decrypt < JWE > PT

for more info, see clevis-encrypt-tang(1) 👑

🔥 TPM2 BINDING 🔥

Clevis provides support to encrypt a key in a Trusted Platform Module 2.0 (TPM2) chip. The cryptographically-strong, random key used for encryption gets encrypted using the TPM2 chip, and then at decryption time it gets decrypted using the TPM2 so clevis can decrypt the secret stored in the JWE. genuinely so cool of it.

Encrypting data using the tpm2 pin works the same than the pins mentioned above:

$ clevis encrypt tpm2 '{}' < PT > JWE

The pin has reasonable defaults for its configuration, but a different hierarchy, hash, and key algorithms can be chosen if the defaults used are not suitable. pick your fave, bestie 💅

Decryption also works similar to other pins — only the JWE needs to be provided:

$ clevis decrypt < JWE > PT
note that like other pins, no configuration is used for decryption. this is due clevis storing the public and private keys to unseal the TPM2 encrypted object in the JWE, so clevis can fetch that information from there. it keeps its own receipts bestie 😭

For more information see clevis-encrypt-tpm2(1).

🦋 SHAMIR'S SECRET SHARING 🦋

Clevis provides a way to mix pins together to create sophisticated unlocking and high availability policies. This is accomplished by using an algorithm called Shamir's Secret Sharing (SSS). obsessed.

SSS is a thresholding scheme. It creates a key and divides it into a number of pieces. Each piece is encrypted using another pin (possibly even SSS recursively — yes, it can do that, main character energy). Additionally, you define the threshold t. If at least t pieces can be decrypted, then the encryption key can be recovered and decryption can succeed. slay.

For example, let's create a high-availability setup using Tang:

$ cfg='{"t":1,"pins":{"tang":[{"url":...},{"url":...}]}}'
$ clevis encrypt sss "$cfg" < PT > JWE

In this policy, we are declaring that we have a threshold of 1, but that there are multiple key fragments encrypted using different Tang servers. Since our threshold is 1, so long as any of the Tang servers are available, decryption will succeed. As always, decryption is simply:

$ clevis decrypt < JWE > PT

For more information, see clevis-encrypt-tang(1).

🎀 LUKS BINDING 🎀

Clevis can be used to bind an existing LUKS volume to its automation policy. This is accomplished with a simple command:

$ clevis luks bind -d /dev/sda tang '{"url":...}'

and this command performs four steps, bestie, let's count them down:

  1. Creates a new key with the same entropy as the LUKS master key — maximum entropy bits is 256.
  2. Encrypts the new key with Clevis.
  3. Stores the Clevis JWE in the LUKS header.
  4. Enables the new key for use with LUKS.

This disk can now be unlocked with your existing password as well as with the Clevis policy 🫶 Clevis provides two unlockers for LUKS volumes. First, we provide integration with Dracut to automatically unlock your root volume during early boot. Second, we provide integration with UDisks2 to automatically unlock your removable media in your desktop session. both, because why choose 🔥

For more information, see clevis-luks-bind(1).

👑 SEE ALSO 👑

go read them, iykyk 💜

and that's the whole page bestie!! this one's from CLEVIS(1), dated 10/16/2026 — so like, remember the date, it's giving timestamped documentation energy 📅✨ mwah, go encrypt something 💖🦋💅

📦 where this page comes from