Re: Password hash as LUKS key

[Arno Wagner <arno@wagner.name>]

On Mon, Mar 20, 2023 at 18:06:42 CET, Martin Olsson wrote:
[...]
> >In priciple,
> >this works and is supported, but interactive, pipe and
> >read-from-file are all a bit different.
> 
> So I decided to give it another try. But I'm pretty sure now that Arno
> misunderstood what I wanted to accomplish.
> 
> I want to encrypt the password before piping it to cryptsetup.
> mkpasswd was just an example of that operation. You can also use python
> for example:

As long as you pipe in the same thing on slot password setup and 
on slot unlock, it should work. Does not matter what it looks
like. So using an encrypted password works as long as it is
encrypted the same way each time and the rules for giving
it to cryptsetup are observed.

> "I want to encrypt a drive for a user and I don't want the user to send me
> their password in clear text."

Sure. See above. You may want to have a look at the section
"NOTES ON PASSPHRASE PROCESSING FOR LUKS" in the cryptsetup
man page.

Regards,
Arno 

-- 
Arno Wagner,     Dr. sc. techn., Dipl. Inform.,    Email: arno@wagner.name
GnuPG: ID: CB5D9718  FP: 12D6 C03B 1B30 33BB 13CF  B774 E35C 5FA1 CB5D 9718
----
A good decision is based on knowledge and not on numbers. -- Plato

If it's in the news, don't worry about it.  The very definition of 
"news" is "something that hardly ever happens." -- Bruce Schneier