Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Yubikey integration into firmware for auth or disk keys #32

Closed
osresearch opened this issue Sep 16, 2016 · 2 comments
Closed

Yubikey integration into firmware for auth or disk keys #32

osresearch opened this issue Sep 16, 2016 · 2 comments
Labels
enhancement

Comments

@osresearch
Copy link
Collaborator

A two factor device like the yubikey could be added to the auth process for booting / decrypting.
@osresearch
Copy link
Collaborator Author

osresearch commented Apr 5, 2017 •
edited
Loading

This will require full gpg, not just the limited gpgv. It will also require libusb and the USB kernel modules to be loaded.

It can also be used to store the disk encryption keys for TPM-less systems, although we won't have any measurement support.

osresearch added a commit that referenced this issue Apr 5, 2017
@osresearch
Enable gpg with card support (issue #32)
0da184f
@osresearch osresearch changed the title Yubikey integration into auth Yubikey integration into firmware for auth or disk keys Apr 5, 2017
osresearch added a commit that referenced this issue Apr 5, 2017
@osresearch
fix gpg tty reading from /dev/console to support yubikey (issue #32)
9d6c5c5
osresearch added a commit that referenced this issue Apr 12, 2017
@osresearch
Rework /init and qubes setup scripts (issue #27, #155, #32, #29, #110)
353a0ef 
This adds support for seamless booting of Qubes with a TPM disk key,
as well as signing of qubes files in /boot with a Yubikey.

The signed hashes also includes a TPM counter, which is incremented
when new hashes are signed.  This prevents rollback attacks against
the /boot filesystem.

The TPMTOTP value is presented to the user at the time of entering
the disk encryption keys.  Hitting enter will generate a new code.

The LUKS headers are included in the TPM sealing of the disk
encryption keys.
@osresearch
Copy link
Collaborator Author

It is now possible to use a Yubikey to sign Qubes installations and root filesystems from the recovery shell. This works fairly well and there are scripts to help make it easier.

tlaurion pushed a commit to tlaurion/heads that referenced this issue May 3, 2024
@tasket
fixes & new dedup opts
6bdc147 
fix issue linuxboot#32 and issue #8.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@osresearch