[dm-crypt] Feitian PKI donation to dm-crypt projetc

[dm-crypt] Feitian PKI donation to dm-crypt projetc

[Jean-Michel Pouré - GOOZE]

Dear friends,

We would be happy to offer three Feitian PKI smartcards to the dm-crypt
project. Free Software developer can register here:
http://gooze.eu/feitian-pki-free-software-developer-card

Also, we are currently writing a HOWTO to publish on GOOZE.

Is there a way to enable dm-crypt using opensc-pkcs11.so on startup?
The idea is to have a complete encrypted system on boot.

This probably involves creating an initrd with OpenSSL and OpenSC
included. Did anyone succeed in this?

Kind regards,
Jean-Michel POURE
-- 
                  Jean-Michel Pouré - Gooze - http://www.gooze.eu

Re: [dm-crypt] Feitian PKI donation to dm-crypt projetc

[Christoph Anton Mitterer]

[-- Attachment #1: Type: text/plain, Size: 489 bytes --]

On Wed, 2010-11-03 at 19:26 +0100, Jean-Michel Pouré - GOOZE wrote:
> Is there a way to enable dm-crypt using opensc-pkcs11.so on startup?
> The idea is to have a complete encrypted system on boot.
> 
> This probably involves creating an initrd with OpenSSL and OpenSC
> included. Did anyone succeed in this?
e.g. Debian includes some very basic scripts to use those two, although
they're dis-functional in several cases, you can use them as starting
point.


Cheers,
Chris.

[-- Attachment #2: smime.p7s --]
[-- Type: application/x-pkcs7-signature, Size: 3387 bytes --]

Re: [dm-crypt] Feitian PKI donation to dm-crypt projetc

[Arno Wagner]

On Wed, Nov 03, 2010 at 07:26:12PM +0100, Jean-Michel Pour? - GOOZE wrote:
> Dear friends,
> 
> We would be happy to offer three Feitian PKI smartcards to the dm-crypt
> project. Free Software developer can register here:
> http://gooze.eu/feitian-pki-free-software-developer-card
> 
> Also, we are currently writing a HOWTO to publish on GOOZE.
> 
> Is there a way to enable dm-crypt using opensc-pkcs11.so on startup?
> The idea is to have a complete encrypted system on boot.
> 
> This probably involves creating an initrd with OpenSSL and OpenSC
> included. Did anyone succeed in this?

Having a not completely encrypted initrd and kernel does
not qualify as "completely encrypted system on boot". 

Anyways, this is not really in the dm-crypt/LUKS focus,
although some people go the way of having an initrd that
does set-up an encrypted root. They typically find it 
painful and difficult to set-up, but it is possible.

The main dm-crypt/LUKS focus is encrypted partitions in 
an otherwise not encrypted system.

The only interface for integrating external keys is by
reading them from file or stdin and that is by desing
to keep things simple.

Arno
-- 
Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno@wagner.name 
GnuPG:  ID: 1E25338F  FP: 0C30 5782 9D93 F785 E79C  0296 797F 6B50 1E25 338F
----
Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans

If it's in the news, don't worry about it.  The very definition of 
"news" is "something that hardly ever happens." -- Bruce Schneier 

Re: [dm-crypt] Feitian PKI donation to dm-crypt projetc

[Jean-Michel Pouré - GOOZE]

Le mercredi 03 novembre 2010 à 23:34 +0100, Arno Wagner a écrit :
> The main dm-crypt/LUKS focus is encrypted partitions in 
> an otherwise not encrypted system. 

Thank you for answers. Reading them, I understand I did not explain
correctly. 

I would like to encrypt a whole system using dm-crypt. The problem is
that I have to run pcsc prior to mounting partitions. But then pcsc will
need access to libraries, which need to be on a mounted partition.

Is there a way around?

Kind regards,
-- 
                  Jean-Michel Pouré - Gooze - http://www.gooze.eu

Re: [dm-crypt] Feitian PKI donation to dm-crypt projetc

[Christoph Anton Mitterer]

[-- Attachment #1: Type: text/plain, Size: 634 bytes --]

On Thu, 2010-11-04 at 06:31 +0100, Jean-Michel Pouré - GOOZE wrote:
> I would like to encrypt a whole system using dm-crypt. The problem is
> that I have to run pcsc prior to mounting partitions. But then pcsc will
> need access to libraries, which need to be on a mounted partition.
> 
> Is there a way around?

Simply include all required stuff (binaries libraries, etc) in the
initramfs image.

The (actually booting) kernel and initramfs image need to be unencrypted
anyways.

E.g. Debian brings you nice tools to include something in initramfs
images + its (library)dependencies (copy_exec).


Cheers,
Chris.

[-- Attachment #2: smime.p7s --]
[-- Type: application/x-pkcs7-signature, Size: 3387 bytes --]

Re: [dm-crypt] Feitian PKI donation to dm-crypt projetc

[Arno Wagner]

On Fri, Nov 05, 2010 at 02:48:52PM +0100, Christoph Anton Mitterer wrote:
> On Thu, 2010-11-04 at 06:31 +0100, Jean-Michel Pour?? - GOOZE wrote:
> > I would like to encrypt a whole system using dm-crypt. The problem is
> > that I have to run pcsc prior to mounting partitions. But then pcsc will
> > need access to libraries, which need to be on a mounted partition.
> > 
> > Is there a way around?
> 
> Simply include all required stuff (binaries libraries, etc) in the
> initramfs image.
> 
> The (actually booting) kernel and initramfs image need to be unencrypted
> anyways.
> 
> E.g. Debian brings you nice tools to include something in initramfs
> images + its (library)dependencies (copy_exec).

An alternative would also be a static compile with the library 
functions in the executable. That can be a bit painful to do 
at thimes though and the executable will be pretty large. You
will also need to the the static libraries for that, AFAIK.

Arno
-- 
Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno@wagner.name 
GnuPG:  ID: 1E25338F  FP: 0C30 5782 9D93 F785 E79C  0296 797F 6B50 1E25 338F
----
Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans

If it's in the news, don't worry about it.  The very definition of 
"news" is "something that hardly ever happens." -- Bruce Schneier 

Re: [dm-crypt] Feitian PKI donation to dm-crypt projetc

[Viorel Tabara]

On Fri, 5 Nov 2010 15:21:34 +0100, Arno Wagner <arno@wagner.name> wrote to dm-crypt@saout.de and CC-ed to :
> On Fri, Nov 05, 2010 at 02:48:52PM +0100, Christoph Anton Mitterer wrote:
> > On Thu, 2010-11-04 at 06:31 +0100, Jean-Michel Pour?? - GOOZE wrote:
> > > I would like to encrypt a whole system using dm-crypt. The problem is
> > > that I have to run pcsc prior to mounting partitions. But then pcsc will
> > > need access to libraries, which need to be on a mounted partition.
> > > 
> > > Is there a way around?
> > 
> > Simply include all required stuff (binaries libraries, etc) in the
> > initramfs image.
> > 
> > The (actually booting) kernel and initramfs image need to be unencrypted
> > anyways.
> > 
> > E.g. Debian brings you nice tools to include something in initramfs
> > images + its (library)dependencies (copy_exec).
> 
> An alternative would also be a static compile with the library 
> functions in the executable. That can be a bit painful to do 
> at thimes though and the executable will be pretty large. You
> will also need to the the static libraries for that, AFAIK.
> 

Sources of inspiration I used:
http://en.gentoo-wiki.com/wiki/Booting_encrypted_system_from_USB_stick#Preparing_the_USB_stick 
http://en.gentoo-wiki.com/wiki/DM-Crypt_with_LUKS
http://en.gentoo-wiki.com/wiki/DM-Crypt 

HTH,
Viorel

Re: [dm-crypt] Feitian PKI donation to dm-crypt projetc

[Ma Begaj]

Am 5. November 2010 14:48 schrieb Christoph Anton Mitterer
<christoph.anton.mitterer@physik.uni-muenchen.de>:
> On Thu, 2010-11-04 at 06:31 +0100, Jean-Michel Pouré - GOOZE wrote:
>> I would like to encrypt a whole system using dm-crypt. The problem is
>> that I have to run pcsc prior to mounting partitions. But then pcsc will
>> need access to libraries, which need to be on a mounted partition.
>>
>> Is there a way around?
>
> Simply include all required stuff (binaries libraries, etc) in the
> initramfs image.
>
> The (actually booting) kernel and initramfs image need to be unencrypted
> anyways.
>

two additional ideas to make it more secure:

1. You can put your initramfs image ona usb stick to have it even more secure.

2. A script on a encrypted root partition could compare (upon decryption) md5
checksum of initramfs with the saved md5 checksum (with md5sum) and show
alert message if sums do not match.

Re: [dm-crypt] Feitian PKI donation to dm-crypt projetc

[Jean-Michel Pouré - GOOZE]

Le vendredi 05 novembre 2010 à 17:29 +0100, Ma Begaj a écrit :
> A script on a encrypted root partition could compare (upon decryption)
> md5
> checksum of initramfs with the saved md5 checksum (with md5sum) and
> show
> alert message if sums do not match. 

When using smartcards, secrets are not displayed. So why should we need
to crypt the initramfs at first stage? We only need to boot in first
stage, non-encrypted, and then request secrets from PKCS#11 and uncrypt
the complete system. 

What do you think?
-- 
                  Jean-Michel Pouré - Gooze - http://www.gooze.eu

Re: [dm-crypt] Feitian PKI donation to dm-crypt projetc

[Mario 'BitKoenig' Holbe]

Jean-Michel Pouré - GOOZE <jmpoure@gooze.eu> wrote:
> When using smartcards, secrets are not displayed. So why should we need
> to crypt the initramfs at first stage? We only need to boot in first
> stage, non-encrypted, and then request secrets from PKCS#11 and uncrypt
> the complete system. 

Well, what you should need does primarily depend on what you want to
have, i.e. on your security goals.

If your only security goal is the typical "stolen notebook" scenario,
i.e. prevent off-line access to your data, you don't need to care about
crypted initramfs or whatever.

If your security goals go further and you want to prevent secrets (keys,
passphrases) from being stolen you have to care about things like
root-access, backdoors, loggers, etc. An untrusted initramfs is able to
install such backdoors or loggers - so are untrusted boot-loaders,
BIOSes and hardwares.

If your security goal is to establish a full trust-chain, you have to
care about lot more things.


regards
   Mario
-- 
As a rule, the more bizarre a thing is, the less mysterious it proves to be.
                                    -- Sherlock Holmes by Arthur Conan Doyle

Re: [dm-crypt] Feitian PKI donation to dm-crypt projetc

[Arno Wagner]

On Thu, Nov 04, 2010 at 06:31:53AM +0100, Jean-Michel Pour? - GOOZE wrote:
> Le mercredi 03 novembre 2010 ?? 23:34 +0100, Arno Wagner a ??crit :
> > The main dm-crypt/LUKS focus is encrypted partitions in 
> > an otherwise not encrypted system. 
> 
> Thank you for answers. Reading them, I understand I did not explain
> correctly. 
> 
> I would like to encrypt a whole system using dm-crypt. The problem is
> that I have to run pcsc prior to mounting partitions. But then pcsc will
> need access to libraries, which need to be on a mounted partition.
> 
> Is there a way around?

No. You have to read something from disk in order to boot
and that something needs to be unencrypted. You can do an
initrd that is unencrypted or a boot-sector like
TrueCrypt (and grub 2?), but neither quelifies as full
system encryption.

For dm-crypt, the initrd is the means of coice.

Arno
-- 
Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno@wagner.name 
GnuPG:  ID: 1E25338F  FP: 0C30 5782 9D93 F785 E79C  0296 797F 6B50 1E25 338F
----
Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans

If it's in the news, don't worry about it.  The very definition of 
"news" is "something that hardly ever happens." -- Bruce Schneier 

Re: [dm-crypt] Feitian PKI donation to dm-crypt projetc

[Milan Broz]

On 11/03/2010 11:34 PM, Arno Wagner wrote:

> The only interface for integrating external keys is by
> reading them from file or stdin and that is by desing
> to keep things simple.

I am maintaining it with the basic idea that libcrypsetup/cryptsetup
is simple tool to configure encrypted partitions using kernel crypto.
Nothing more, nothing less.

New api in libcrypsetup provides two trivial interfaces to get
passphrase or key - directly provided buffer (owned by application)
or keyfile.

For the compatibility reasons it fallbacks to read from
terminal/stdin but the focus is to move passphrase reading
into application responsibility.

IOW if anyone want to handle LUKS mapping in program
(imagine e.g. systemd - issue of these days) it can use
libcryptsetup and handle safe password reading dialog
in application.

(Using stdin in cryptsetup in scripts is problematic - you cannot
control and wipe all buffers. But this option will be always there.
I mean constructions like echo "password" | cryptsetup luksOpen ...)

Handling of various tokens and cards is always wrapper around
cryptsetup - (either scripts or binaries linked to libcryptsetup).

Maybe one day these scripts will be part of upstream tarball,
currently it is up to the distribution to add them.

Milan

Re: [dm-crypt] Feitian PKI donation to dm-crypt projetc

[Heinz Diehl]

On 04.11.2010, Arno Wagner wrote: 

> Having a not completely encrypted initrd and kernel does
> not qualify as "completely encrypted system on boot". 

How would you boot such a system when initramfs / initrd is encrypted?
I'm just curious.

Re: [dm-crypt] Feitian PKI donation to dm-crypt projetc

[Mario 'BitKoenig' Holbe]

Heinz Diehl <htd@fancy-poultry.org> wrote:
> On 04.11.2010, Arno Wagner wrote: 
>> Having a not completely encrypted initrd and kernel does
> How would you boot such a system when initramfs / initrd is encrypted?

Enable your boot-loader to decrypt it. Meanwhile, grub can do this.

This somewhat reduces but, of course, not eliminates the trust-problem:
instead of having to trust your hardware, BIOS, boot-loader, kernel, and
initramfs, you now have to trust your hardware, BIOS, and boot-loader
only.


regards
   Mario
-- 
Wine is fine, but wiskey is quicker. Suicide is slow with liquor.
                                                 -- Ozzy Osbourne

Re: [dm-crypt] Feitian PKI donation to dm-crypt projetc

[Arno Wagner]

On Thu, Nov 04, 2010 at 01:57:23PM +0100, Mario 'BitKoenig' Holbe wrote:
> Heinz Diehl <htd@fancy-poultry.org> wrote:
> > On 04.11.2010, Arno Wagner wrote: 
> >> Having a not completely encrypted initrd and kernel does
> > How would you boot such a system when initramfs / initrd is encrypted?
> 
> Enable your boot-loader to decrypt it. Meanwhile, grub can do this.

One other option is trusted hardware, that can do the initial
decryption.
 
> This somewhat reduces but, of course, not eliminates the trust-problem:
> instead of having to trust your hardware, BIOS, boot-loader, kernel, and
> initramfs, you now have to trust your hardware, BIOS, and boot-loader
> only.

I completely agree. And with trusted hardware, you still have to 
trust the hardware. However, there is some (limited) benefit, 
namely the earlier in the boot process, the harder it gets for
an attacker, i.e. the more expensive. 

Also, with good trusted hardware, remote attacks become infeasible 
and you have to physically access the hardware. The same could be 
done with booting from a write-protected memory stick or CD/DVD.

In all cases a class vulnerability remains, namely that everything
is open once the system runs. This is one reason, why encrypted
root is basically only worthwhile if the attacker _has_
physical access. But in that case a whole set of new attacks
become possible, that encryption does not help against, such
as hardware-keyloggers, patched BIOSes, changes to your read-only
boot-medium, etc..

I doubt that system encryption does help a lot in cases other
than when the complete system gets stolen (laptop). But then
normal system encryption for Windoes (e.g. TrueCrytp), and 
data+tmp+var+swap encryption for Linux is quite enough. 

Side note: Benefit of a chipcard in the scope of disk encryption
is that people that have trouble with passwords do not need to 
remember them. I really don't see any other. This can be a valid
application, though.

Arno
-- 
Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno@wagner.name 
GnuPG:  ID: 1E25338F  FP: 0C30 5782 9D93 F785 E79C  0296 797F 6B50 1E25 338F
----
Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans

If it's in the news, don't worry about it.  The very definition of 
"news" is "something that hardly ever happens." -- Bruce Schneier 

Re: [dm-crypt] Feitian PKI donation to dm-crypt projetc

[Milan Broz]

On 11/03/2010 07:26 PM, Jean-Michel Pouré - GOOZE wrote:
> We would be happy to offer three Feitian PKI smartcards to the dm-crypt
> project. Free Software developer can register here:
> http://gooze.eu/feitian-pki-free-software-developer-card
> 
> Also, we are currently writing a HOWTO to publish on GOOZE.
> 
> Is there a way to enable dm-crypt using opensc-pkcs11.so on startup?
> The idea is to have a complete encrypted system on boot.

Hi,
see my response later in this thread - it is not directly cryptsetup/dm-crypt
job but it is closely related.

> This probably involves creating an initrd with OpenSSL and OpenSC
> included. Did anyone succeed in this?

I can probably send this to people who maintain such things in Fedora distro,
but maybe you already did that.

Milan