I would like to have a physical key to decrypt Linux machines at boot. This is just an idea and I would like to know if there are already projects or established methods to achieve this. Let me explain better. I would like to have an usb device full of random data no partition, then make this thumb read only. First of all: is this possible? Is there some kind of bit that would prevent data write? Something like the SD physical lock, just not physical. Then: what encryption with Linux? I would like to have a pre-boot authentication with simmetrical encryption.. With the hash of the random data key as password.

And a last question: are there some kind of ASIC usb devices to speedup encryption?

Thank you all.

  • I once had an USB key with a physical write lock switch. – Matrix Dec 2 '13 at 8:50

You can create a LUKS volume that relies on a keyfile, rather than on some user input.

There's a guide here, but I've not followed it myself. It seems quite sound though, from a quick read through.

LUKS USB key unlock

Consider also the pros and cons of doing this. A pro is that your key can be longer than you could comfortably remember, but a con is that it's physical, and easily stolen. If you're looking for a higher level of security, I expect it's possible to require both a keyfile and passphrase (at the same time, that gives you more stuff to forget/lose).

Weigh up your options before doing something like this.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.