Nitrokey / nitrokey-documentation

User documentation of Nitrokey's products
https://docs.nitrokey.com
32 stars 36 forks source link

refactor disk encryption documentation #121

Open schaarsc opened 1 year ago

schaarsc commented 1 year ago

File: [pro/linux/hard-disk-encryption.rst] https://docs.nitrokey.com/pro/linux/hard-disk-encryption.html

I'd like to suggest to refactor the disk encryption documentation. The goal of this refactoring would be to give a better overview of all the options (before going into too much details)

For example https://docs.nitrokey.com/pro/linux/ has two pages about disk encryption https://docs.nitrokey.com/pro/linux/disk-encryption-luks https://docs.nitrokey.com/pro/linux/hard-disk-encryption

instead I'd suggest to only have one "Hard Disk Encryption" page which gives an overview of the options, for example

To encrypt data at rest / on disk several options are available

* VeraCrypt / TrueCrypt: Creates a virtual encrypted disk within a file and mounts it as a real disk. <link details>
* Luks / dm-crypt: <link details>
* EncFS provides an encrypted filesystem in user-space <link details>
* eCryptfs is a file based transparent encryption file system for GNU+Linux which can be used with Nitrokey through a PKCS#11 driver. <link details>
* systemd-cryptenroll
  * pkcs11-token <link details>
  * fido2 <link details>

Full Disk Encryption
If your system partion is encrypted this is also called full disk encryption. In this case the disk is decrypted during the boot process.
The decryption itself is based on one of the options listed above, but the system setup/configuriation may differ
* Example based on OpenPGP <link>
* Example based on systemd and x509 certificates <link>
* Example based on systemd and FIDO2 <link>

Depending on the type of device this intro page would only list available options.

The menu on the left would have an additional level, for example

Nitrokey 3
-> Linux
--> Hard disk encryption
---> OpenPGP card / VeraCrypt
---> OpenPGP card / LUKS
---> OpenPGP card / EncFS
---> OpenPGP card / systemd
---> FIDO / systemd
---> OpenPGG card / Full Disk
---> FIDO / Full Disk