Re: unbound keys
Ondrej Kozina <[email protected]>
| Newsgroups | gmane.linux.kernel.device-mapper.dm-crypt |
|---|---|
| Message-ID | <[email protected]> |
On 3/31/20 10:49 AM, Ondrej Kozina wrote: > >> >> Since the unbound feature does the encryption: is it compatible with a smart card (PGP/GPG)? >> >> sudo cryptsetup luksAddKey --unbound --master-key-file ../lukstest/publickey.pem /dev/sdb --key-size 512 ../lukstest/privatekey > > No, that's not how unbound keys work. With this command in particular > you'd add new unbound keyslot where content would be first 64 bytes of > publickey.pem file. Passphrase for that unbound keyslot would be > privatekey file content. > To make the example and explanation more complete: You can store secret in unbound keyslot. So technically you may use LUKS2 unbound keyslot as a safe storage for any secret, even one completely unrelated to cryptsetup/LUKS or disk encryption at all. Unfortunately we don't provide unbound keyslot dump into file from CLI (you may create issue on gitlab for it). Although it's possible to do it using libcryptsetup API: If interested, see: - crypt_keyslot_add_by_key(), you'll need CRYPT_VOLUME_KEY_NO_SEGMENT flag to create unbound keyslot - crypt_volume_key_get(), you'll have to ask for specific 'keyslot' id, of unbound keyslot created by previous crypt_keyslot_add_by_key. - crypt_keyslot_status() to find what keyslot is actually unbound I'm not sure this is most practical use for LUKS2 unbound keyslot, but who knows:) Regards O. _______________________________________________ dm-crypt mailing list [email protected] https://www.saout.de/mailman/listinfo/dm-crypt