4 ms·
Is it possible to set up an encrypted+authenticated boot that relies on a hardware token being present? In other words, only boot this OS if the Yubikey is inse
by bloopernova 5y ago
Is it possible to set up an encrypted+authenticated boot that relies on a hardware token being present? In other words, only boot this OS if the Yubikey is inserted?
- kevincox 5y agoIt definitely is. The easiest way is to set up the token in challenge-response mode (supported by yubikey). The disk has a key which is sent to the token and the response is used to decrypt the disk.
- sam_lowry_ 5y agoDoes not LUKS already work with Yubikeys [1]? [1] https://github.com/cornelinux/yubikey-luks https://github.com/cornelinux/yubikey-luks
- kevincox 5y agoBased on the description of that repo it does exactly what I suggested you can do.
- maverwa 5y agoAccording to the docs ([0], [1]) systemd-cryptenroll and crypttab support FIDO2 and PKCS#11, both should be supported by the yubikey as well. So without having tested it: I think yes, it should generally be possible, at least for encryption. [0]: https://www.freedesktop.org/software/systemd/man/crypttab.html https://www.freedesktop.org/software/systemd/man/crypttab.ht... [1]: https://www.freedesktop.org/software/systemd/man/systemd-cryptenroll.html# https://www.freedesktop.org/software/systemd/man/systemd-cry...
- nsajko 5y agoSee my top-level comment. Just put the initrd and secret on the external device.
- egberts1 5y agoDid you just assumed that /bin and initd are separate by the virtue of “cloning-by-initd” and thusly needing to be differently signed by necessity?