I've setup arch using dm-crypt / luks, with a passphrase and a key, lost one of them will fail to login.
But I feel I need more secure of passphrase, how to setup dm-crypt / luks that has one-time passphrase mechanism?
2
-
I am not exactly sure as to what exactly you are trying to set up. Can you be more explicit? Are you asking about how you would implement something like HOTP for luks? How do you suggest it gets the appropriate time (and where does it store the secret securely?) for time based HOTP? What about a DOS attack with turn based HOTP? I think you are trying to solve a problem you already solved (with a yubikey or alike, I assume)– Tobi NaryJan 22, 2019 at 13:40
-
My current setup that includes one slot of luks that one for passphrase and the key - here I use an usb that store detached luks header. When I insert usb and enter passphrase I can be able to login the system. So the key is detached header - I'm assuming. I don't know how about time but if there's algorithm to generate the passphrase for use only one-time - this is similar to google authenticator. @TobiNary– Tuyen PhamJan 23, 2019 at 2:04
Add a comment
|
2 Answers
Setting up a OTP is probably not something you can easily and securely do. There are other options to solve your problem -
LUKS supports up to 8 simultaneous passphrases. You can fairly easily set one of these to something different,long, complex and obscure (or a key file) and put it in an offsite secure location.
Similarly, if you take a copy of the LUKS header (which has other benefits) you can set the header with a different initial key to the regular keys, and then restore that - this would alloe the key and header coy to be stored in different locations to make it harder to compromise. See https://www.lisenet.com/2013/luks-add-keys-backup-and-restore-volume-header/ on how to save the header and use multiple passphrases/keys
Better options are:
- TPM unlocking,
- FIDO2/U2F unlocking,
- PKI card unlocking.
It can be all done by
systemd-cryptenrolland the Arch wiki has detailed instructions on all. Just search on it.
I personally use TPM for unmanaged unlocks and with PIN for user data.
For dynamic unlocks (like removable USB drives) I prefer FIDO2 (which requires a user PIN, but for instance the Yubikey Bio can use your fingerprint for U2F unlocking as an additional factor, but that is nonstandard).
Never forget to add a passphrase in extra (generated for hight entropy, cryptenroll support makes it for you if (refer to the man)) and backing up the LUKS headers ;).
