[dm-crypt] Two Factor Authentication With LUKS

[dm-crypt] Two Factor Authentication With LUKS

[marcos marrero]

[-- Attachment #1: Type: text/plain, Size: 368 bytes --]

Good Morning,

Is there any way that I LUKS can be edited where it allows a token + password in order to decrypt the data? Everything that I find has to do with a key file and I dont want to use a key file I want to use a token (like an RSA token or google authenticator ) + password. Can you please guide me in the right direction.  
 
Very Respectfully,


JR.

[-- Attachment #2: Type: text/html, Size: 1067 bytes --]

Re: [dm-crypt] Two Factor Authentication With LUKS

[Arno Wagner]

No. cryptsetup does not know or understadnm tokens. You can 
read the passprase from stdin (see man-page) and thereby construct
a wrapper involwing another software you have to supply that can
deal with a token. 

But you should know than an RSA token does not provide any secret 
when used to authenticate. It proves that it knows a secret, but 
that secret is not transferred. Hence an RSA token is not suitable
for use with disk encryption. 

Arno

On Tue, Jun 17, 2014 at 15:47:52 CEST, marcos marrero wrote:
> Good Morning,
> 
> Is there any way that I LUKS can be edited where it allows a token +
> password in order to decrypt the data?  Everything that I find has to do
> with a key file and I dont want to use a key file I want to use a token
> (like an RSA token or google authenticator ) + password.  Can you please
> guide me in the right direction.   
>  
> Very Respectfully,
> 
> 
> JR.

> _______________________________________________
> dm-crypt mailing list
> dm-crypt@saout.de
> http://www.saout.de/mailman/listinfo/dm-crypt


-- 
Arno Wagner,     Dr. sc. techn., Dipl. Inform.,    Email: arno@wagner.name
GnuPG: ID: CB5D9718  FP: 12D6 C03B 1B30 33BB 13CF  B774 E35C 5FA1 CB5D 9718
----
A good decision is based on knowledge and not on numbers. -  Plato

Re: [dm-crypt] Two Factor Authentication With LUKS

[Yves-Alexis Perez]

[-- Attachment #1: Type: text/plain, Size: 712 bytes --]

On mar., 2014-06-17 at 20:11 +0200, Arno Wagner wrote:
> But you should know than an RSA token does not provide any secret 
> when used to authenticate. It proves that it knows a secret, but 
> that secret is not transferred. Hence an RSA token is not suitable
> for use with disk encryption. 

Well, if the hardware device is able to decrypt something (like a pkcs11
token or an OpenPGP smartcard, for example), it's at least possible to
store an encrypted keyfile somewhere accessible at boot, then ask the
token for decryption and feed that to cryptsetup.

I'm not sure if google authenticator and the RSA token you're talking
about fits in that description though.

Regards,
-- 
Yves-Alexis

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 473 bytes --]

Re: [dm-crypt] Two Factor Authentication With LUKS

[Arno Wagner]

On Wed, Jun 18, 2014 at 17:37:14 CEST, Yves-Alexis Perez wrote:
> On mar., 2014-06-17 at 20:11 +0200, Arno Wagner wrote:
> > But you should know than an RSA token does not provide any secret 
> > when used to authenticate. It proves that it knows a secret, but 
> > that secret is not transferred. Hence an RSA token is not suitable
> > for use with disk encryption. 
> 
> Well, if the hardware device is able to decrypt something (like a pkcs11
> token or an OpenPGP smartcard, for example), it's at least possible to
> store an encrypted keyfile somewhere accessible at boot, then ask the
> token for decryption and feed that to cryptsetup.

True, but then the disk-encryption is done via that Smartcard or
pkcs11 token. The RSA token would just communicate with them
and not with the disk-encryption and it becomes a different 
problem.
 
> I'm not sure if google authenticator and the RSA token you're talking
> about fits in that description though.

I am not sure either. 

Arno
-- 
Arno Wagner,     Dr. sc. techn., Dipl. Inform.,    Email: arno@wagner.name
GnuPG: ID: CB5D9718  FP: 12D6 C03B 1B30 33BB 13CF  B774 E35C 5FA1 CB5D 9718
----
A good decision is based on knowledge and not on numbers. -  Plato