From: Kris Moore <kris@pcbsd.org>
To: grub-devel@gnu.org
Subject: Question about GRUB/GELI support
Date: Fri, 26 Sep 2014 13:11:36 -0400 [thread overview]
Message-ID: <54259E48.4040502@pcbsd.org> (raw)
Hey, quick question about GRUB's support for GELI. We are using it to
boot Free/PC-BSD with GELI v5, and it works great there. However FreeBSD
updated their geli implementation very slightly to v7, which only
changes which part of the master key is used for encrypt / decrypt.
https://github.com/freebsd/freebsd/commit/38de8ef1dd0e468ff1e3ec1c431f465e270beba3
I think the line in GRUB that needs tweaking is on or around 440 of
grub-core/disk/geli.c, where it calls grub_crypto_pbkdf2 (dev->hash.....
I'm having trouble figuring out which part of that would be the
equivalent of Freebsd's mkey -> ekey change, or if that data is even
exposed in GRUB's version. Any tips or pointers?
I'm also doing some other patches to GRUB so we can pass the GELI key as
a variable to the kernel, skipping the prompting at mount-root. That
seems to work well, but I wanted to see if I could knock out both fixes
at the same time. Once its done, I'll be happy to forward the patch for
upstream inclusion.
Thanks!
--
Kris Moore
PC-BSD Software
iXsystems
next reply other threads:[~2014-09-26 17:12 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-09-26 17:11 Kris Moore [this message]
2014-09-27 6:15 ` Question about GRUB/GELI support Andrei Borzenkov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=54259E48.4040502@pcbsd.org \
--to=kris@pcbsd.org \
--cc=grub-devel@gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).