search

cornelinux / yubikey-luks

Two factor authentication for harddisk encryption
614 stars 58 forks source link

Would it make sense to include some LUKS partition data item to make the response unique? #70

Open cobratbq opened 3 years ago

cobratbq commented 3 years ago

This week I have discovered the yubikey-luks package inside debian/ubuntu. I'm reading up a bit on how the mechanism works. Now I'm left with the following question. IIUC the resulting response is - in its basic configuration - solely dependent on the password entered which is used as challenge. This means, that if you use this mechanisms on multiple PCs, capturing the result on one PC gives you the passphrase to use on other PC's.

Could we include something unique/identifying of the LUKS partition (e.g. partition UUID) to make the response of the challenge - and therefore the response - distinct for each PC?

update I am having second thoughts about using the UUID, as it is likely changeable, so would corrupt the key slot. I am still curious to your opinion on this.

update to add reasoning:

In the end, you receive a consistent response from the security key, so whatever you do, you cannot protect from capturing the final secret value that unlocks the LUKS partition. This is not a goal.

However, you can avoid that you can discover the secret with only the security key accessible. Including a piece of unique/distinct LUKS/partition information in the challenge, means that you need to have access to the partition at least once - in addition to having access to the security key.

Vincent43 commented 3 years ago

Yes uuid is changeable so there will be significant risk of locking out user from the data.

cobratbq commented 3 years ago

Updated description to include rationale: if we use a piece of unique information from the partition/LUKS, we ensure that both the security key and the partition need to be accessible once before the secret value that decrypts the LUKS partition can be discovered.

Samdaaman commented 2 years ago

I had a similar idea!

@cobratbq check out this pull request (or this branch on my fork)

Obviously this is a beta feature that I have developed myself so would recommend that you have a master password that you can unlock the partition with normally if the feature fails for whatever reason