I've setup arch using dm-crypt / luks, with a passphrase and a key, lost one of them will fail to login.
But I feel I need more secure of passphrase, how to setup dm-crypt / luks that has one-time passphrase mechanism?
-
I am not exactly sure as to what exactly you are trying to set up. Can you be more explicit? Are you asking about how you would implement something like HOTP for luks? How do you suggest it gets the appropriate time (and where does it store the secret securely?) for time based HOTP? What about a DOS attack with turn based HOTP? I think you are trying to solve a problem you already solved (with a yubikey or alike, I assume) – Tobi Nary Jan 22 '19 at 13:40
-
My current setup that includes one slot of luks that one for passphrase and the key - here I use an usb that store detached luks header. When I insert usb and enter passphrase I can be able to login the system. So the key is detached header - I'm assuming. I don't know how about time but if there's algorithm to generate the passphrase for use only one-time - this is similar to google authenticator. @TobiNary – Tuyen Pham Jan 23 '19 at 2:04
Setting up a OTP is probably not something you can easily and securely do. There are other options to solve your problem -
LUKS supports up to 8 simultaneous passphrases. You can fairly easily set one of these to something different,long, complex and obscure (or a key file) and put it in an offsite secure location.
Similarly, if you take a copy of the LUKS header (which has other benefits) you can set the header with a different initial key to the regular keys, and then restore that - this would alloe the key and header coy to be stored in different locations to make it harder to compromise. See https://www.lisenet.com/2013/luks-add-keys-backup-and-restore-volume-header/ on how to save the header and use multiple passphrases/keys
