From mboxrd@z Thu Jan 1 00:00:00 1970 From: Vagrant Cascadian Subject: Re: Unencrypted boot with encrypted root Date: Tue, 07 Apr 2020 09:47:19 -0700 Message-ID: <878sj7i6p4.fsf@ponder> References: <87ftdmi7pp.fsf@ambrevar.xyz> <17c316adc8485d1f09f70d291cfaad50258c6c1f.camel@wine-logistix.de> <20200403194423.m3pvz654qslug7g3@pelzflorian.localdomain> <20200404101832.cmegsybfyrseazjq@pelzflorian.localdomain> <4610a9147fa041ebb47f184a2d3f7878a8a2539c.camel@wine-logistix.de> <87d08jbpcc.fsf@gnu.org> <135d8491-53e8-46b6-b77a-fe6a4539b15d@www.fastmail.com> Mime-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" Return-path: Received: from eggs.gnu.org ([2001:470:142:3::10]:54032) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1jLrOD-0004WL-2L for guix-devel@gnu.org; Tue, 07 Apr 2020 12:47:54 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1jLrOB-0006Zr-2K for guix-devel@gnu.org; Tue, 07 Apr 2020 12:47:52 -0400 Received: from cascadia.aikidev.net ([173.255.214.101]:51362) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1jLrOA-0006XC-T6 for guix-devel@gnu.org; Tue, 07 Apr 2020 12:47:51 -0400 In-Reply-To: <135d8491-53e8-46b6-b77a-fe6a4539b15d@www.fastmail.com> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane-mx.org@gnu.org Sender: "Guix-devel" To: Alex Griffin , guix-devel@gnu.org --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 2020-04-07, Alex Griffin wrote: > On Tue, Apr 7, 2020, at 9:46 AM, Ludovic Court=C3=A8s wrote: >> The difficulty is that any file traveling through the store is >> world-readable. It=E2=80=99s hard to avoid. > > If we can create the key file outside of the store, then GRUB is capable = of being passed multiple initrds. So we can put the key in its own initrd (= outside of the store), continue to generate the normal initrd in /gnu/store= , and pass both of them to GRUB. The key never enters the store in any way. > > The result is that the user only needs to enter a password into GRUB, bec= ause GRUB then passes the key file to the kernel. I believe it's also possible for grub to provide the key derived/decrypted from the passphrase entered at run-time, obviating the need for a separate key entirely. I don't have details on how to do this, but I *think* that's what recent Debian installs do... it certainly would simplify key slot management issues. live well, vagrant --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iHUEARYKAB0WIQRlgHNhO/zFx+LkXUXcUY/If5cWqgUCXoyumQAKCRDcUY/If5cW qoE/AQDlBiP9I28Ut/Su6F/Vnfx1URZWUvpjfj/ZqQvkVZZCzgD6A787P4yJl+m0 +02AabFno0zSEVdadDPY+arm/lpNLgE= =8hEj -----END PGP SIGNATURE----- --=-=-=--