search

agherzan / yubikey-full-disk-encryption

Use YubiKey to unlock a LUKS partition
Apache License 2.0
795 stars 50 forks source link

Add silent fail feature #85

Open dramm33 opened 2 years ago

dramm33 commented 2 years ago

As per #68, I added an option to auto-skip unlock.

I called it "silent fail" since I lack a better name for it. It's not really silent since it still outputs that decryption was tried and skipped.

Vincent43 commented 2 years ago

I'm bit skeptical about adding this as it may be too uncommon usecase while I'm trying to limit number of settings in order to make code simpler. Do you ever need to unlock this partition at boot? If not then you may just remove ykfde hook from initramfs and unlock it later with ykfde-open if needed.

dramm33 commented 2 years ago

I'm using ykfde to unlock a fully encrypted disk (which doesn't have OS/boot files).

That being said, the files on the disk are accessed by some system services, which means unlocking it at login isn't an option.

The main advantage I see when using the hook is that when I don't want the drive unlocked, I just need to remove the Yubikey before starting the computer. And if I need to use the Yubikey for some other authentication later, I can just plug it in without worrying about having the drive accidentally unlocked.

As for being too uncommon, I guess it depends whether or not you want to consider computers with multiple drives or not. I agree that it doesn't make sense for something like a laptop with only one fully encrypted disk.

Vincent43 commented 2 years ago

I think what's uncommon in your setup is not multiple drives used but the fact that OS data is unencrypted which doesn't follow Full disk encryption concept for which this project was dedicated (as the name of it tells).

dramm33 commented 2 years ago

Yeah, I will eventually encrypt the OS disk as well. But I'm postponing since I will still need to keep the other disk on a different level of security. So I'd need to use two yubikeys (one for OS disk and the other for protected data disk).

Since the computer is on most of the time, having everything under one encryption would mean keeping unnecessary data unencrypted all the time. Which I'm not a big fan of.

Anyway, I digress. Feel free to close the request.

agherzan commented 2 years ago

I see @Vincent43 's point on added complexity for an uncommon use-case. I find your setup very custom and I'm not sure if we have more people that would use something similar. I'd say to park this for a while and wait for feedback on the issue.