From 6c3efdc7c7d3c1e1e9f130bfb37c644e1ac0b4bf Mon Sep 17 00:00:00 2001
From: sarthurdev <965089+sarthurdev@users.noreply.github.com>
Date: Tue, 15 Jul 2025 13:21:54 +0200
Subject: tpm: T7628: Fix non-TPM backed encryption

---
 src/helpers/vyos-config-encrypt.py | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

(limited to 'src')

diff --git a/src/helpers/vyos-config-encrypt.py b/src/helpers/vyos-config-encrypt.py
index 9c35d90f5..b658b8f43 100755
--- a/src/helpers/vyos-config-encrypt.py
+++ b/src/helpers/vyos-config-encrypt.py
@@ -76,16 +76,17 @@ def load_config(key):
 
     return True
 
-def encrypt_config(key, recovery_key):
+def encrypt_config(key, recovery_key=None, is_tpm=True):
     if is_opened():
         raise Exception('An encrypted config volume is already mapped')
 
     # Clear and write key to TPM
-    try:
-        clear_tpm_key()
-    except:
-        pass
-    write_tpm_key(key)
+    if is_tpm:
+        try:
+            clear_tpm_key()
+        except:
+            pass
+        write_tpm_key(key)
 
     persist_path = cmd(persistpath_cmd).strip()
     size = ask_input('Enter size of encrypted config partition (MB): ', numeric_only=True, default=512)
@@ -268,7 +269,7 @@ if __name__ == '__main__':
             print('Backup the recovery key in a safe place!')
             print('Recovery key: ' + recovery_key.decode())
         elif args.enable:
-            encrypt_config(recovery_key)
+            encrypt_config(recovery_key, is_tpm=False)
 
             print('Encrypted config volume has been enabled without TPM')
             print('Backup the key in a safe place!')
-- 
cgit v1.2.3