Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I would like to have a physical key to decrypt Linux machines at boot. This is just an idea and I would like to know if there are already projects or established methods to achieve this. Let me explain better. I would like to have an usb device full of random data no partition, then make this thumb read only. First of all: is this possible? Is there some kind of bit that would prevent data write? Something like the SD physical lock, just not physical. Then: what encryption with Linux? I would like to have a pre-boot authentication with simmetrical encryption.. With the hash of the random data key as password.

And a last question: are there some kind of ASIC usb devices to speedup encryption?

Thank you all.

share|improve this question
I once had an USB key with a physical write lock switch. –  Matrix Dec 2 '13 at 8:50
add comment

closed as off-topic by Terry Chia, Adnan, Xander, Lucas Kauffman, NULLZ Dec 2 '13 at 13:00

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer

up vote 0 down vote accepted

You can create a LUKS volume that relies on a keyfile, rather than on some user input.

There's a guide here, but I've not followed it myself. It seems quite sound though, from a quick read through.

LUKS USB key unlock

Consider also the pros and cons of doing this. A pro is that your key can be longer than you could comfortably remember, but a con is that it's physical, and easily stolen. If you're looking for a higher level of security, I expect it's possible to require both a keyfile and passphrase (at the same time, that gives you more stuff to forget/lose).

Weigh up your options before doing something like this.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.