3 ms·
Are you still using LUKS for these? How are you invoking decryption with the pass phrase protected key?
by alexeldeib 3y ago
Are you still using LUKS for these? How are you invoking decryption with the pass phrase protected key?
- adrian_b 3y agoI am not using LUKS, I am using a custom kernel module that implements a block device that presents to the kernel the decrypted SSD. The kernel module receives the key when it is loaded, then it creates the block device that is eventually mounted as the new root device. I do not know if LUKS could be used for this, I have not examined it. IIRC, LUKS stores the actual decryption key in the encrypted disk (protected by a passphrase) or in the TPM, like most commercial products for disk encryption, which are methods that I do not approve.
- gameoverhumans 3y agoLUKS supports detached headers, maybe this would be useful for your setup? https://wiki.archlinux.org/title/Dm-crypt/Specialties#Encrypted_system_using_a_detached_LUKS_header https://wiki.archlinux.org/title/Dm-crypt/Specialties#Encryp... Your approach sounds pretty cool, by the way. I've thought about such an approach in the past, and I've used it for some auxiliary computers under my control, but not for my daily driver. I have a Framework laptop and I could indeed use this approach in quite a stylish way, though: https://frame.work/de/en/products/storage-expansion-card?v=FRACCFBZ02 https://frame.work/de/en/products/storage-expansion-card?v=F...
- adrian_b 3y agoThanks for pointing to this LUKS feature. The last time when I have looked at LUKS was some years ago, when this feature did not exist yet. In my opinion, this is the only right way to do SSD/HDD encryption. The detached header allows plausible deniability and it avoids downgrading the strength of the encryption key to the strength of the passphrase. By using the detached header option, LUKS could be used exactly like in my custom setup.