-
-
Notifications
You must be signed in to change notification settings - Fork 189
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Signing /boot without physical gpg key device #921
Comments
Not in current Heads codebase. A USB security dongle is required, for which signing operations depends on gpg --card-status and where private key is on external dongle. Any implementation ideas on workflow? The private key could be injected in rom and only require the user to type associated passphrase... But that would lower security. How to detect and propose to user to connect USB disk to load private key seemlessly? @bencejuhaasz The private key would be in encrypted LUKS container on USB disk? |
I know at least one person that would like to test out heads without the need of a security dongle. This person know that its insecure to have private and public key on a unencrypted usb drive just as files that everyone can read. |
Iterative thought process happening. Corrently, all heads codebase but the following takes into consideration the use of a smartcard, calling gpg without a homedir, where The following are the exception, specifying
We could "replace" a smartcard by a LUKS encrypted container's partition, having local, non homedir bounded gpg calls, taking into consideration that
Code changes that would be required under Heads:
My thought experiment is that all other gpg calls are plainly depending on bindings between public key and private key identity being offloaded to card ID. So gpg here is simply requesting that smartcard presence linked to public key, to offload its operations after the mapping is done through Thoughts, better idea? |
The outcome of this should be used to document linuxboot/heads-wiki#62 |
I've found a soultion since. I just had to remove the line checking for a physical device, and import my encrypted key with gpg, saying "N" for changing things. But sadly now I can't use heads, as I've switched to arch linux, so I'm locked to secure boot. |
Implemented under #1515 |
Can I sign /boot with a software gpg key from a usb stick, without specific hardware for storing keys ? I can import my public key but the UI won't sign anything or import my private key, only from a special smartcard device.
The text was updated successfully, but these errors were encountered: