Mick Reed | 30 Jul 23:37

A12-140 Piping two gpg'ed keys to cryptsetup luksAddKey

This may be a feature request, or just a call for some bash scripting help:

I would like to add a (piped, gpg'ed) key to a luks partition that was 
originally formatted with a piped key from gpg:

Create the container
# gpg --decrypt --quiet 2>>/dev/null first_key.gpg | cryptsetup \
    luksFormat /dev/partition

So gpg will ask for my passphrase for my (usb random) key, and then pipe the 
decrypted output to cryptsetup, creating the container.

Now comes the question:  how to pipe in the original key and a new piped key 
at the same time, for the luksAddKey action.

I have tried unsuccessfully to use the --key-file=- option and some bash 
constructs like (subshells) and {code blocks} along with pipes.  The best I 
have been able to do is get the new key in, but with a <cr> added or some 
other mangling.  That doesn't work, when later trying to luksOpen the 
container with the new key.

To clarify further, I don't want to use an intermediate or temporary cleartext 
key, or UUencode either of the random gpg keys.  I also don't want to take 
the key apart and write it to a temporary file.

If we can't find a way to do this, I will be happy to help with a patch.  I am 
not a good enough coder to solve this on my own, yet.  I do think there is a 
need for this, please offer any suggestions.  Thanks!

Mick Reed
(Continue reading)

Till Maas | 7 Aug 12:10
Favicon

Re: A12-140 Piping two gpg'ed keys to cryptsetup luksAddKey

Mick Reed wrote:

> Create the container
> # gpg --decrypt --quiet 2>>/dev/null first_key.gpg | cryptsetup \
>     luksFormat /dev/partition

> If we can't find a way to do this, I will be happy to help with a patch. 
> I am
> not a good enough coder to solve this on my own, yet.  I do think there is
> a
> need for this, please offer any suggestions.  Thanks!

This works for me with bash:

# cryptsetup  luksFormat /dev/loop0 <(cat key1)
# cryptsetup  --key-file <(cat key1) luksAddKey /dev/loop0 <(cat key2)
# cryptsetup --key-file <(cat key2) luksOpen /dev/loop0 foo

Btw. piping keyfiles to cryptsetup without using --key-file may be a bad
idea. Iirc at least older versions of cryptsetup did not use the full
keyfile for encryption, e.g. when it contained newline characters.

Regards,
Till

Pasi Kärkkäinen | 7 Aug 13:38
Favicon

Re: Re: A12-140 Piping two gpg'ed keys to cryptsetup luksAddKey

On Thu, Aug 07, 2008 at 12:10:03PM +0200, Till Maas wrote:
> Mick Reed wrote:
> 
> > Create the container
> > # gpg --decrypt --quiet 2>>/dev/null first_key.gpg | cryptsetup \
> >     luksFormat /dev/partition
> 
> > If we can't find a way to do this, I will be happy to help with a patch. 
> > I am
> > not a good enough coder to solve this on my own, yet.  I do think there is
> > a
> > need for this, please offer any suggestions.  Thanks!
> 
> This works for me with bash:
> 
> # cryptsetup  luksFormat /dev/loop0 <(cat key1)
> # cryptsetup  --key-file <(cat key1) luksAddKey /dev/loop0 <(cat key2)
> # cryptsetup --key-file <(cat key2) luksOpen /dev/loop0 foo
> 
> Btw. piping keyfiles to cryptsetup without using --key-file may be a bad
> idea. Iirc at least older versions of cryptsetup did not use the full
> keyfile for encryption, e.g. when it contained newline characters.
> 

Yep, I noticed this with RHEL 5.1 / CentOS 5.1 .. cryptsetup only used the
first line from the file. 

Dunno if it is fixed in EL 5.2 or in upstream cryptsetup.. 

-- Pasi
(Continue reading)

Mick Reed | 8 Aug 01:51

Re: Re: A12-140 Piping two gpg'ed keys to cryptsetup luksAddKey

> # cryptsetup  luksFormat /dev/loop0 <(cat key1)
> # cryptsetup  --key-file <(cat key1) luksAddKey /dev/loop0 <(cat key2)
> # cryptsetup --key-file <(cat key2) luksOpen /dev/loop0 foo

Yes, This works for me as well, but when I change <(cat key1) to 
<(gpg --decrypt --quiet /media/disk/key1.gpg) it no longer works.  I tried 
some quoting there, but no luck yet.  

> Btw. piping keyfiles to cryptsetup without using --key-file may be a bad
> idea. Iirc at least older versions of cryptsetup did not use the full
> keyfile for encryption, e.g. when it contained newline characters.
>

My experience is that it works.  At least I have not had any problems with my 
256 bit keys and several different ones at that.  I have made at least 6 
containers with different keys, and they could be luksOpened.


Gmane