Re: Using Windows and bitlocker

Jun. 19, 2025 5:53:07 p.m. Michael Kj=C3=B6rling <[email protected]>:
> Microsoft's Bitlocker, LUKS on Linux, VeraCrypt, and others are
> examples of _full-disk encryption_ (FDE) solutions.

So while that is a common use-case, a full-disk (to encrypt) in the Linux c=
ontext at least is just a block device.=C2=A0 Block devices don't have to b=
e full disks though. They can be any of many partial disk abstractions whet=
her that is partitions, LVM LVs, etc.

> Full-disk encryption is mainly about protecting _data at rest_. The
> typical example is if someone steals a laptop, or an external storage
> device used to hold backups. (It's also useful in other situations, of
> course.)

Indeed.=C2=A0 Again, the common example/use-case.=C2=A0 But I think there c=
an be others.

I have occaisionally consdered a hybrid approach.

Imagine that I have data that I want encrypted at rest.=C2=A0 But I also do=
n't want it mounted at boot because I want system boots to be succesful whe=
n unattended.=C2=A0 But I also don't want to "stash" the decryption key on =
the machine so that boots can happen unattended.=C2=A0 So what I really wan=
t is this encrypted-at-rest data to be (decrypted and) mounted on demand, l=
ike with autofs.

Further I imagine that each user authorized to decrypt the data has their o=
wn key (for revocation purposes) for the decryption.=C2=A0 A key that decry=
pts the master key for them.=C2=A0 I think LUKS already has this concept as=
 "slots" doesn't it?

As I imagine this system, it reminds me roughly of how Kerberos works with =
users having a password to obtain a ticket-granting-ticket which then allow=
s them to obtain crypto credentials for various services on various systems=
 in the network.=C2=A0 A "key to obtain a key" kind of system.

This system I imagine also doesn't allow other users (such as root) access =
to the mounted data because it's mounted encrypted and is only available un=
-encrypted to the users that have keys for it.

This might all be very pie-in-the-sky thinking and not actually even techni=
cally be possible.=C2=A0 It's something I have somewhat-often imagined havi=
ng.

Cheers,
b.