this post was submitted on 31 Jul 2026
26 points (100.0% liked)

Linux

66775 readers
664 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 7 years ago
MODERATORS
nooter692@lemmy.ml
MarcellusDrum@lemmy.ml
cypherpunks@lemmy.ml
cyclohexane@lemmy.ml
26
Unlocking LUKS with NitroKey/Yubikey: FIDO2, HMAC-SHA1, or OpenPGP? (thebrainbin.org)
submitted 3 days ago by modem_down@thebrainbin.org to c/linux@lemmy.ml
13 comments fedilink hide all child comments
 

Which approach do you think is better, and why?

  1. FIDO2
  2. HMAC-SHA1
  3. OpenPGP (alternative guide)

Or do you think there is an even better way to use a hardware security token to unlock drives having LUKS full disk encryption?

top 13 comments
sorted by: hot top controversial new old
[–] fruitycoder@sh.itjust.works 2 points 13 hours ago* (last edited 13 hours ago)

I try to follow a multi-factor, multi-domain model.

So if I am wanting to verify that data is on the system I except it to be then TPM keys and measured boot is what I use. To verify it is on the network I expect I use a Tang server. To verify I have possession of a device I use, a hardware token and password.

You could do all the above, or mix match depending on the system. For example for servers I assume they need to boot without user intervention, so password is set as backup to the Tang server. I still use hardware token to buy just for quick revoktion of verification (i.e. I know a server is compromised or could be soon, I can just pull a USB out).

The same setup works for my laptops, which makes my network because of Tang act as trusted domain as well.

So again multi-factor (something you have, know, are, do) and multi-domain (network, user, machine).

I use Clevis to do the multi-key unlocks.

[–] modem_down@thebrainbin.org 3 points 2 days ago

Progress report 1

  • I'm ruling out HMAC-SHA1, because:
  • If using systemd, pick FIDO2:
    • Avoids flaws of HMAC-SHA1.
    • Native support in systemd, so "future-proof".
    • Wider support than OpenPGP. More HST vendors to choose from, including cheaper options than NitroKey or Yubikey: useful if each sysadmin (or colleague, or relative) needs an HST.
    • Compatible with QubesOS.
  • Otherwise, OpenPGP:
    • Like FIDO2, solves HMAC-SHA1 flaws.
    • However:
      • smartcard-key-luks seems unmaintained on GitHub and on GitLab.
      • LUKS with OpenPGP isn't well-documented for non-Debian-based distros.
  • TBD: Clevis/Tang:
    • Remote/network-based unlocking.
[–] utopiah@lemmy.ml 2 points 2 days ago (1 children)

https://support.nitrokey.com/t/unlocking-luks-volume-with-nitrokey-3-on-debian-12-2/5553/15 could be useful too

[–] modem_down@thebrainbin.org 1 points 2 days ago

Thank you for this! That thread is helpful in itself, and also links to other relevant resources - including by Lennart Poettering (controversial guy, but the canonical source on systemd).

[–] eldavi@lemmy.ml 1 points 3 days ago (2 children)

wouldn't doing this require that building a ram disk image with the yubikey software included?

[–] kayohtie@pawb.social 5 points 3 days ago

All 3 mechanisms are native to a yubikey, and do not require yubikey-specific software/drivers to function as they use USB standards like FIDO2, keyboard for HMAC, and PIV/CCID for OpenPGP.

FIDO2 is built-in out-of-the-box, HMAC just requires adding the key to HMAC on slot 1 or 2 (tap vs long-hold key-inputs) using the personalization tool, or using gpg(2) to card-edit for OpenPGP.

None of these require YK software to operate.

[–] modem_down@thebrainbin.org 2 points 3 days ago (1 children)

Which of the 4 recipes I posted are you referring to as "this"?

[–] eldavi@lemmy.ml 2 points 3 days ago (1 children)

read them and you will see that only ones mentions initrd at all.

[–] modem_down@thebrainbin.org 2 points 3 days ago (1 children)

I read them before writing my OP. I'm still not sure what you're getting at.

I would be grateful if you could say what you mean, instead of initiating an oblique guessing game.

[–] eldavi@lemmy.ml 1 points 3 days ago (2 children)

instead of initiating an oblique guessing game.

i don't understand the hostility.

i asked a question about needing yubikey software in a ramdisk image to enable decryption at boot time and most of the sources you provided don't mention it at all.

[–] floquant@lemmy.dbzer0.com 3 points 2 days ago

It's not mentioned because it's not required, yubikeys in general mostly leverage pre-existing "smartcard" facilities

[–] kkremitzki@lemmy.ml 5 points 3 days ago (1 children)

i don’t understand the hostility.

Bystander observation: you were asked to clarify but essentially refused in a way that took more effort than simply doing so.

[–] eldavi@lemmy.ml 1 points 3 days ago

Oic. They didn't understand that I was asking a question and thought that I was addressing one of their links

Thanks for helping clarify.