Re: [dm-crypt] two factor authentication with zuluCrypt

[Arno Wagner <arno@wagner.name>]

On Mon, Oct 17, 2011 at 05:47:31PM +0200, Milan Broz wrote:
> On 10/17/2011 04:39 PM, .. ink .. wrote:
> > Why doesnt cryptsetup support two factor authentication?
> 
> I like the Unix approach - one simple program, one function.

The thing is that you cannot do 2-factor authentication 
generically. You typically have password/passphrase as
one factor, and that can be done generically and is implemented
in cryptsetup. However the second factor is usually a token
or biometrics and there is no way to do these generically. 
They always have to be customized to the concrete solution.
While there are generic smarcard indterfaces, they are
still problematic for this use.

I think the present approach is prefectly fine. It is also easy 
to script in a concrete token or biometrics, just use a longer
passphrase and split it, as originally suggested. Or use
the library, although that does not provide a conceptyal
security increase as compared to scripting.

> cryptsetup is nothing more than low-level configuration
> for dmcrypt and on-disk metadata (key management) wrapper.
> And provides library covering that.
> 
> You can build various plugins (see e.g. how pam_mount
> or systemd uses libcryptsetup) but I would like to cryptsetup
> remains simple utility just for this exact task.
> 
> (But maybe we should add various wrappers to code tree later.)

I can see that happening, e.g. as soon as there is a stable token 
standard with working multi-vendor support. Or if, for example, 
there is a widely-adopted standard for a smartphone to prove its
presence (misusing a phone as a token).

Arno
-- 
Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno@wagner.name 
GnuPG:  ID: 1E25338F  FP: 0C30 5782 9D93 F785 E79C  0296 797F 6B50 1E25 338F
----
Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans

If it's in the news, don't worry about it.  The very definition of 
"news" is "something that hardly ever happens." -- Bruce Schneier