I've setup arch using dm-crypt / luks, with a passphrase and a key, lost one of them will fail to login.
But I feel I need more secure of passphrase, how to setup dm-crypt / luks that has one-time passphrase mechanism?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this communityI've setup arch using dm-crypt / luks, with a passphrase and a key, lost one of them will fail to login.
But I feel I need more secure of passphrase, how to setup dm-crypt / luks that has one-time passphrase mechanism?
Setting up a OTP is probably not something you can easily and securely do. There are other options to solve your problem -
LUKS supports up to 8 simultaneous passphrases. You can fairly easily set one of these to something different,long, complex and obscure (or a key file) and put it in an offsite secure location.
Similarly, if you take a copy of the LUKS header (which has other benefits) you can set the header with a different initial key to the regular keys, and then restore that - this would alloe the key and header coy to be stored in different locations to make it harder to compromise. See https://www.lisenet.com/2013/luks-add-keys-backup-and-restore-volume-header/ on how to save the header and use multiple passphrases/keys