search

coreycothrum / meta-mender-luks

mender with LUKS encrypted partitions
MIT License
11 stars 5 forks source link

idea: cryptsetup (online) reencrypt for unique LUKS master key #6

Closed coreycothrum closed 1 year ago

coreycothrum commented 3 years ago

Current LUKS keys are defined @ build time. All devices provisioned from that build share the same LUKS master key.

Would it be good to perform a cryptsetup reencrypt? Ideally just once. This would give each device unique keys.

Probably some sort of systemd service @ boot time.

https://man7.org/linux/man-pages/man8/cryptsetup.8.html