Keyslots
Passphrase, FIDO2, TPM 2.0, macOS Secure Enclave, and hybrid post-quantum keyslots.
LUKSbox vaults can hold up to 8 keyslots, each independently capable of unlocking the vault. Mix-and-match across types is supported.
| Keyslot kind | What unlocks it | Backup-friendly |
|---|---|---|
| Passphrase | Argon2id-stretched passphrase | Yes - any passphrase you remember |
| FIDO2 hmac-secret | Touch + PIN on a CTAP2 hardware key | Yes - enroll multiple devices |
| FIDO2 derived MVK | Touch + PIN; vault literally has no wrapped MVK on disk | No - lose the key, lose the vault |
| TPM 2.0 | The machine's TPM (no PIN, with PIN, or fused TPM+FIDO2) | No without a backup slot - bound to the chip |
| Secure Enclave | The Mac's Secure Enclave (plain, Touch ID, or fused with FIDO2 / a passphrase) | No without a backup slot - bound to the Mac |
| Hybrid post-quantum | Passphrase / FIDO2 / TPM / SEP, plus a separate .kyber seed file |
Yes - same as base type |
For a vault you care about, the recommended setup is:
- One passphrase slot (paper-backup-friendly)
- One FIDO2 slot for daily use
- Optional second FIDO2 slot for redundancy (different device)
- Optional TPM 2.0 slot (Linux) or Secure Enclave slot (macOS) to bind the vault to the local machine (must be paired with a passphrase or FIDO2 backup slot)
- Optional hybrid-PQ wrapper if your threat model includes "harvest now, decrypt later" against a future quantum computer
See the recovery guide for what happens when you lose any of these.
- Passphrase keyslots Argon2id-stretched passphrase, the universal fallback keyslot.
- FIDO2 keyslots YubiKey, Google Titan, Nitrokey, Windows Hello - hardware-backed unlock.
- Post-quantum keyslots Hybrid ML-KEM-768 / 1024 keyslots - when, why, how.
- TPM 2.0 keyslots Bind a vault to the local machine's TPM. Optional PIN, fused TPM + FIDO2, hybrid TPM + post-quantum.
- Secure Enclave keyslots (macOS) Bind a vault to your Mac's Secure Enclave. Optional Touch ID, fused SEP + FIDO2 or SEP + passphrase, hybrid SEP + post-quantum.