Package: cryptsetup Version: 2:1.0.4+svn26-1 Severity: wishlist Tags: patch
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
I've put together some scripts that work with cryptsetup and
initramfs-tools that require a smartcard at boot to decrypt the key
material for a dm-crypt volume.
/lib/cryptsetup/scripts/decrypt_opensc:
Waits for card reader to be attached and card inserted, then prompts
for PIN and outputs the raw key material
/etc/initramfs-tools/hooks/cryptopensc:
Detects whether hooks/cryptroot has installed the decrypt_opensc
script into the initramfs, and if so, installs additional binaries for
reading smartcards at boot (binaries from pcscd and opensc pakcages).
/etc/initramfs-tools/scripts/local-top/cryptopensc:
Detects whether pcscd had been installed in the initramfs and starts
this daemon.
/etc/initramfs-tools/scripts/local-bottom/cryptopensc:
Detects whether pcscd had been installed in the initramfs and stops
this daemon.
The following is an example /etc/crypttab:
root /dev/md2 /boot/keys/root
offset=2048,cipher=aes-cbc-essiv:sha256,size=256,hash=plain,check,keyscript=/lib/cryptsetup/scripts/decrypt_opensc
The file /boot/keys/root contains the key material that has been
encrypted with the RSA public key on the smart card. The following
commands were used to create this file:
$ dd if=/dev/random of=key_material bs=1 count=96
$ pkcs15-tool --read-public-key 45 --output public_key
$ openssl rsautl -in key_material \
-pubin -inkey public_key \
-pkcs -out /boot/keys/root
$ shred key_material
The following pages have been very helpful in learning OpenSC in
combination with dm-crypt:
http://keitin.net/jarpatus/projects/usbtoken/index_fin.shtml
http://www.saout.de/tikiwiki/tiki-index.php?page=RSAFirstSectorsMiniHOWTO
Personally I created the private key with OpenSSL rather than let the
card generate the key, this way I can store the same key on a backup
smart card. Also I did not store the encrypted key in the first
sectors of the disk, instead the key is read from an unencrypted /boot
volume.
Speaking of where to store the key, unfortunately LUKS cannot be used
with the symmetric key stored on the smart card, however the following
blog has some neat ideas about making that work:
http://www.readingfordummies.com/blog/archives/2007/02/index.html
Any feedback is welcome at Gerald Turner <[EMAIL PROTECTED]>
- -- System Information:
Debian Release: 4.0
APT prefers testing
APT policy: (500, 'testing')
Architecture: amd64 (x86_64)
Shell: /bin/sh linked to /bin/bash
Kernel: Linux 2.6.18-4-amd64
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Versions of packages cryptsetup depends on:
ii dmsetup 2:1.02.08-1 The Linux Kernel Device Mapper use
ii libc6 2.3.6.ds1-13 GNU C Library: Shared libraries
ii libdevma 2:1.02.08-1 The Linux Kernel Device Mapper use
ii libgcryp 1.2.3-2 LGPL Crypto library - runtime libr
ii libgpg-e 1.4-1 library for common error values an
ii libpopt0 1.10-3 lib for parsing cmdline parameters
ii libuuid1 1.39+1.40-WIP-2006.11.14+dfsg-2 universally unique id library
cryptsetup recommends no packages.
- -- no debconf information
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
iD8DBQFGCrQMP6CBD/qM1tURAvHqAJ9gY7X7yiQ5XJVSN0A0r3JpA05uPwCfeVB0
Aft6p9xeVhTMu0T4OMCAB18=
=s/zv
-----END PGP SIGNATURE-----
cryptsetup-opensc.tar.gz
Description: Binary data
