Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Unlocking LUKS2 Volumes with TPM2, FIDO2, PKCS#11 Security HW on Systemd 248

0pointer.net

Post reply on HN
Print view View original

1–10 of 102 posts

Re: Unlocking LUKS2 Volumes with TPM2, FIDO2, PKCS#11 Security HW on Systemd 248

#3

Post by shaicoleman »

resoluteteeth wrote: post #2

Does the yubikey "security key" series (the ones that only do u2f/fido2) support the necessary extension?

It seems like it's only available on the Yubikey 5 Series

https://support.yubico.com/hc/en-us/articles/360016649319-Yu...

Re: Unlocking LUKS2 Volumes with TPM2, FIDO2, PKCS#11 Security HW on Systemd 248

#5

Post by tialaramex »

resoluteteeth wrote: post #2

Does the yubikey "security key" series (the ones that only do u2f/fido2) support the necessary extension?

Edited to update: Nope :(

My Security Key 2 reports lacking this extension.

This is what the comment said before I updated it, in case it's important context for replies:

I believe that they do implement hmac-secret yes. For what it's worth this is the same feature (for the same reason) you need to enroll FIDO authenticators to unlock a Windows system, so if you use one to do that today, it definitely ought to work with this too.

I intend to spend the next few minutes playing with code to check I'm correct about this, but I might get distracted, so either there will be an edit saying I was right, saying I was wrong, or no edit because I watched Youtube.

Re: Unlocking LUKS2 Volumes with TPM2, FIDO2, PKCS#11 Security HW on Systemd 248

#6

Post by resoluteteeth »

shaicoleman wrote: post #3
resoluteteeth wrote: post #2

Does the yubikey "security key" series (the ones that only do u2f/fido2) support the necessary extension?

It seems like it's only available on the Yubikey 5 Series https://support.yubico.com/hc/en-us/articles/360016649319-Yu...

Thanks. That's too bad.

Re: Unlocking LUKS2 Volumes with TPM2, FIDO2, PKCS#11 Security HW on Systemd 248

#7

Post by resoluteteeth »

tialaramex wrote: post #5
resoluteteeth wrote: post #2

Does the yubikey "security key" series (the ones that only do u2f/fido2) support the necessary extension?

Edited to update: Nope :( My Security Key 2 reports lacking this extension. This is what the comment said before I updated it, in case it's important context for replies: I believe that they do implement hmac-secret yes. For what it's worth this is the same feature (for the same reason) you need to enroll FIDO authenticators to unlock a Windows system, so if you use one to do that today, it definitely ought to work w…

The chart at the top of shaicoleman's link indicates that the security key series doesn't support it. I also just tested the hmac_secret.py sample from the python fido2 library and it didn't work with a yubikey security key nfc.

Re: Unlocking LUKS2 Volumes with TPM2, FIDO2, PKCS#11 Security HW on Systemd 248

#8

Post by madars »

I tolerate systemd as I want to use a popular distro for desktop use, but given the project's dismal security record (and attitude!) I can't trust systemd explicitly handling cryptographic secrets. No thank you; there are better options available https://wiki.archlinux.org/index.php/YubiKey#Full_disk_encry...

Re: Unlocking LUKS2 Volumes with TPM2, FIDO2, PKCS#11 Security HW on Systemd 248

#10

Post by resoluteteeth »

madars wrote: post #8

I tolerate systemd as I want to use a popular distro for desktop use, but given the project's dismal security record (and attitude!) I can't trust systemd explicitly handling cryptographic secrets. No thank you; there are better options available https://wiki.archlinux.org/index.php/YubiKey#Full_disk_encry...

Is systemd's encryption a replacement for existing software like LUKS or just a wrapper around it?
Post reply on HN