diff --git a/recipes-core/base-files/base-files_%.bbappend b/recipes-core/base-files/base-files_%.bbappend
index 4756ee1..e3d3c51 100644
--- a/recipes-core/base-files/base-files_%.bbappend
+++ b/recipes-core/base-files/base-files_%.bbappend
@@ -18,4 +18,5 @@ do_install:append() {
 	install -m 0644 ${WORKDIR}/locale.conf ${D}${sysconfdir}
 	install -m 0644 ${WORKDIR}/vconsole.conf ${D}${sysconfdir}
 	install -d ${D}/data
+	install -d ${D}${sysconfdir}/keys
 }
diff --git a/recipes-core/images/core-image-minimal-initramfs.bbappend b/recipes-core/images/core-image-minimal-initramfs.bbappend
index 80de457..cda9dc2 100644
--- a/recipes-core/images/core-image-minimal-initramfs.bbappend
+++ b/recipes-core/images/core-image-minimal-initramfs.bbappend
@@ -5,6 +5,7 @@ INITRAMFS_SCRIPTS = "\
                       initramfs-module-debug \
                       initramfs-module-cryptfs \
                       initramfs-module-cryptfs-tpm2 \
+                      initramfs-module-ecryptfs \
                     "
 
 PACKAGE_INSTALL = "\
diff --git a/recipes-core/initrdscripts/files/cryptfs b/recipes-core/initrdscripts/files/cryptfs
index 08c96e9..ab5df58 100644
--- a/recipes-core/initrdscripts/files/cryptfs
+++ b/recipes-core/initrdscripts/files/cryptfs
@@ -49,38 +49,38 @@ cryptfs_gen_passphrase() {
 cryptfs_run() {
 	# Similar to rootfs, we need to wait for the device to become available
 	C=0
-	delay=${bootparam_rootdelay:-1}
-	timeout=${bootparam_roottimeout:-5}
-	#while true; do
-	#	if [ $(( $C * $delay )) -gt $timeout ]; then
-	#		fatal "root '$bootparam_root' doesn't exist or does not contain a /dev."
-	#	fi
+	delay=${bootparam_datadelay:-1}
+	timeout=${bootparam_datatimeout:-5}
+	while true; do
+		if [ $(( $C * $delay )) -gt $timeout ]; then
+			fatal "root '$bootparam_data' doesn't exist or does not contain a /dev."
+		fi
 
-	#	if [ -n "$bootparam_root" ]; then
-	#		root_dev="$bootparam_root"
-	#		if [ "`echo ${bootparam_root} | cut -c1-5`" = "UUID=" ]; then
-	#			root_uuid=`echo $bootparam_root | cut -c6-`
-	#			root_dev=`readlink -f /dev/disk/by-uuid/$root_uuid`
-	#		elif [ "`echo ${bootparam_root} | cut -c1-9`" = "PARTUUID=" ]; then
-	#			root_partuuid=`echo $bootparam_root | cut -c10-`
-	#			root_dev=`readlink -f /dev/disk/by-partuuid/$root_partuuid`
-	#		elif [ "`echo ${bootparam_root} | cut -c1-10`" = "PARTLABEL=" ]; then
-	#			root_partlabel=`echo $bootparam_root | cut -c11-`
-	#			root_dev=`readlink -f /dev/disk/by-partlabel/$root_partlabel`
-	#		elif [ "`echo ${bootparam_root} | cut -c1-6`" = "LABEL=" ]; then
-	#			root_label=`echo $bootparam_root | cut -c7-`
-	#			root_dev=`readlink -f /dev/disk/by-label/$root_label`
-	#		fi
+		if [ -n "$bootparam_data" ]; then
+			root_dev="$bootparam_data"
+			if [ "`echo ${bootparam_data} | cut -c1-5`" = "UUID=" ]; then
+				root_uuid=`echo $bootparam_data | cut -c6-`
+				root_dev=`readlink -f /dev/disk/by-uuid/$root_uuid`
+			elif [ "`echo ${bootparam_data} | cut -c1-9`" = "PARTUUID=" ]; then
+				root_partuuid=`echo $bootparam_data | cut -c10-`
+				root_dev=`readlink -f /dev/disk/by-partuuid/$root_partuuid`
+			elif [ "`echo ${bootparam_data} | cut -c1-10`" = "PARTLABEL=" ]; then
+				root_partlabel=`echo $bootparam_data | cut -c11-`
+				root_dev=`readlink -f /dev/disk/by-partlabel/$root_partlabel`
+			elif [ "`echo ${bootparam_data} | cut -c1-6`" = "LABEL=" ]; then
+				root_label=`echo $bootparam_data | cut -c7-`
+				root_dev=`readlink -f /dev/disk/by-label/$root_label`
+			fi
 
-	#		[ -e "$root_dev" ] && break
-	#	fi
-	#	debug "Sleeping for $delay second(s) to wait root to settle..."
-	#	sleep $delay
-	#	C=$(( $C + 1 ))
-	#done
+			[ -e "$root_dev" ] && break
+		fi
+		debug "Sleeping for $delay second(s) to wait root to settle..."
+		sleep $delay
+		C=$(( $C + 1 ))
+	done
 
 	flags=""
-	root_dev="/dev/mmcblk0p3"
+	#root_dev="/dev/mmcblk0p3"
 	mounted_dir="/data"
 	key_slot=8
 
diff --git a/recipes-core/initrdscripts/files/ecryptfs b/recipes-core/initrdscripts/files/ecryptfs
new file mode 100644
index 0000000..cb523b0
--- /dev/null
+++ b/recipes-core/initrdscripts/files/ecryptfs
@@ -0,0 +1,111 @@
+#!/bin/sh
+
+#!/bin/sh
+#@author: vincent.benoit <vincent.benoit@scle.fr>
+#@date: 10/2023
+#@brief: ecryptfs and TPM
+
+check_tpm2() {
+	if [ ! -e /sys/class/tpm ]; then
+		echo "Linux TPM subsystem not found"
+		exit 1
+	fi
+}
+
+ecryptfs_enabled() {
+	return 0
+}
+
+create_tpm_prim_key() {
+	local dirpath=$1
+	if [ -z ${dirpath} ]; then
+		echo "err: dir path (${dirpath}) doesn't exist"
+		exit 1
+	fi
+
+	check_tpm2
+
+	local contextfile=${dirpath}/key.ctxt
+	local ret=`/usr/bin/tpm2_createprimary --key-algorithm=rsa2048 --key-context=${contextfile}`
+	if [ $? -ne 0 ]; then
+		echo "err: create primary failed"
+		exit 1
+	fi
+}
+
+persistent_handle() {
+	local handle=$1
+	storage_prim_key=""
+	local tmp_res=/tmp/persist.txt
+	local ret=`/usr/bin/tpm2_evictcontrol -c ${handle} > ${tmp_res}`
+	if [ $? -eq 0 ]; then
+		local res=`cat ${tmp_res} | tail -1 | awk -F ": " '{print $2}'`
+		if [ $res == "persisted" ]; then
+			# store handle to var
+			storage_prim_key=`cat ${tmp_res} | head -n 1 | awk -F ": " '{print $2}'`
+		fi
+	fi
+}
+
+create_key_master_key() {
+	local handle=$1
+	local keypath=$2
+
+	if [ -z ${handle} ]; then
+		echo "err: handle (${handle}) empty"
+		exit 1
+	fi
+
+	echo "add kmk-trusted from TPM ..."
+	local kmk=`/bin/keyctl add trusted kmk-trusted "new 32 keyhandle=${handle}" @u`
+	if [ $? -eq 0 ]; then
+		echo "pipe kmk-trusted to file ..."
+		if [ -f "${keypath}" ]; then
+			echo "warn: ${keypath} already exists"
+		fi
+		local res=`/bin/keyctl pipe ${kmk} > ${keypath}`
+		if [ $? -eq 0 ]; then
+			echo "revoke kmk-trusted"
+			/bin/keyctl revoke ${kmk}
+		fi
+	fi
+}
+
+create_encrypted_key() {
+	local keypath=$1
+	local filename="ecryptfs-encrypted.blob"
+
+	echo "add ecryptfs key from trusted kmk ..."
+	local encrypted=`/bin/keyctl add encrypted 1001100110011001 "new ecryptfs trusted:kmk-trusted 64" @u`
+	if [ $? -eq 0 ]; then
+		echo "pipe encrypted key to file ..."
+		if [ -f "${keypath}" ]; then
+			echo "warn: ${keypath} already exists"
+		fi
+		local res=`/bin/keyctl pipe ${encrypted} > ${keypath}`
+		if [ $? -eq 0 ]; then
+			echo "revoke ecryptfs-encrypted key"
+			/bin/keyctl revoke ${encrypted}
+		fi
+	fi
+}
+
+ecryptfs_run() {
+	kmk_filename="kmk-trusted.blob"
+	encrypted_filename="ecryptfs-encrypted.blob"
+
+	if [ ! -f "$ROOTFS_DIR/etc/keys/${kmk_filename}" ] && [ ! -f "$ROOTFS_DIR/etc/keys/${kmk_filename}" ]; then
+		echo "*-* create TPM primary key *-*"
+		create_tpm_prim_key /tmp
+		echo "*-* persistent handle *-*"
+		persistent_handle /tmp/key.ctxt
+		echo "*-* storage primary key: ${storage_prim_key} *-*"
+		/bin/keyctl clear @u
+		/bin/keyctl link @u @s
+		echo "*-* create_key_master_key *-*"
+		create_key_master_key ${storage_prim_key} "$ROOTFS_DIR/etc/keys/${kmk_filename}"
+		echo "*-* create_encrypted_key *-*"
+		create_encrypted_key "$ROOTFS_DIR/etc/keys/${encrypted_filename}"
+	fi
+	echo "*-* END *-*"
+}
diff --git a/recipes-core/initrdscripts/initramfs-framework_%.bbappend b/recipes-core/initrdscripts/initramfs-framework_%.bbappend
index d005d2d..c45e791 100644
--- a/recipes-core/initrdscripts/initramfs-framework_%.bbappend
+++ b/recipes-core/initrdscripts/initramfs-framework_%.bbappend
@@ -8,12 +8,14 @@ SRC_URI:append = " \
                    file://dmverity \
                    file://cryptfs \
                    file://cryptfs_tpm2 \
+                   file://ecryptfs \
                  "
 
 PACKAGES:append = " \
                     initramfs-module-verity \
                     initramfs-module-cryptfs \
                     initramfs-module-cryptfs-tpm2 \
+                    initramfs-module-ecryptfs \
                   "
 
 do_install:append() {
@@ -23,6 +25,7 @@ do_install:append() {
     install -d ${D}/${sysconfdir}/cryptfs
     install -m 0644 ${WORKDIR}/cryptfs_tpm2 ${D}/${sysconfdir}/cryptfs/tpm2
     install -m 0755 ${WORKDIR}/cryptfs ${D}/init.d/95-cryptfs
+    install -m 0755 ${WORKDIR}/ecryptfs ${D}/init.d/96-ecryptfs
 }
 
 SUMMARY:initramfs-module-verity = "initramfs support for dm-verity filesystems"
@@ -56,3 +59,14 @@ RDEPENDS:initramfs-module-cryptfs-tpm2 = " \
 FILES:initramfs-module-cryptfs-tpm2 = " \
                                         ${sysconfdir}/cryptfs/tpm2 \
                                       "
+
+
+SUMMARY:initramfs-module-ecryptfs = "encrypted directory with support for tpm 2.0"
+RDEPENDS:initramfs-module-ecryptfs = " \
+                                       ${@bb.utils.contains('MACHINE_FEATURES', 'tpm2', 'libtss2 libtss2-mu libtss2-tcti-device', '', d)} \
+                                       tpm2-tools \
+                                       keyutils \
+                                     "
+FILES:initramfs-module-ecryptfs = " \
+                                    /init.d/96-ecryptfs \
+                                  "