search

google / fscrypt

Go tool for managing Linux filesystem encryption
Apache License 2.0
894 stars 98 forks source link

[Feature] Automatically re-use recovery protector when re-using login protector #252

Open Redsandro opened 4 years ago

Redsandro commented 4 years ago

Encrypting a new directory with a new v2 policy re-uses the login protector. However, it does not re-use the recovery protector, but creates a new one (Y/n). User ends up with multiple directories with the same login protector but different recovery protectors.

After offering to create a recovery protector (recommended), perhaps fscrypt can ask if the user would like to re-use [list all keys with "Recovery" in the description] or create a new one.

Or detect what recovery protector is used by another policy that uses the login protector.

In the end it makes sense for the user to have the same recovery passphrase for directories that use the same login protector.

josephlr commented 4 years ago

This was exactly my thinking, will probably mesh well with #249