search

xaionaro-go / trezorCipherKeyValue

A pipeline utility to encrypt/decrypt a key by a "Trezor One" device using "CipheredKeyValue" function
GNU General Public License v3.0
3 stars 1 forks source link

Support PIN from external program #1

Closed petrkr closed 6 years ago

petrkr commented 6 years ago

As I want use this in boot I need stdout clear, because cryptsetup in ubuntu/mint call keyscript and PIPE its output to cryptosetup as password.

But if trezor have enabled password, ncurses PIN entry wlll also write to stdout and will add mess to password.

There are two solutions print everything to stderr in that case. But also I need (if plymouth is active and used) call external script/command for user's input.

I suggest somethings like "trezorCipherKeyValue --pincommand "/path/to/exec" and instead creating own pin entry method, call this script and read it's stdout as PIN.

for testing you can use for example "askpass" command from ubuntu/mint mostly in /lib/cryptosomething/askpass

xaionaro commented 6 years ago

Fixed. I removed pinentry usage at all (replaced by "/lib/cryptsetup/askpass" by default). It can be changed using option -a.

TREZOR_CIPHER_VALUE="test data" trezorCipherKeyValue -e -H
xaionaro commented 6 years ago

P.S.: So within initrd you can use:

TREZOR_CIPHER_VALUE="trezor&luks" trezorCipherKeyValue -d | cryptsetup <command> --key-file - [options]