- Joined
- May 5, 2022
Please don't overstate my abilities. The only reason I know this is because my agricultural job also requires encryption since I do basically everything (including handling customer info) and I don't trust any vendor (They're all cloud and Saas these days) nor other employees...You are obviously overflowing with knowledge on this stuff. Grant me your wisdom, oh beneficent one -- If I wanted to store the keys on a separate device and require it for starting up my planned home-built NAS (but obviously not leave it plugged in the whole time or it's pointless in the case of theft), what should I be looking at? Just a regular old USB drive or something more sophisticated? I believe there are Yubi Keys and presumably competitors. They'd let me lock the drive the keys are on, plug it in on the occasions I need to reboot the NAS, hide it in a sock the rest of the time, right?
I don't like biometrics since they are not precise enough and in the USA the 5th/4th amendments do not apply to biometric information (retinal, facial, finger, etc).
For the media it can be any removable media. I've done it for shits and giggles once with a VHS tape... I think you are looking at a Yubikey over SSH solution and a keyfile. You "can" use a yubikey support for LUKS, but only with systemd (to my knowledge) on any base system or this project but I do not know much about it. Otherwise you would have to write your own code.
You can also use a one use key, that is how encrypted swap is setup but I would be careful since that would not have a backup... The other keys would also be able to unlock the files I think if they had the (older) header...
For your choice you have a few options:
GnuPG encrypted keyfile on removable media
Removeable media keyfile
Plain* format on removable media
Keyfile on removable media
Detached LUKS header for the above also possible.
Password
Hint: Make backups on of keyfile/header since fucking bitrot.
*See this for explanation on plain vs LUKS:
2.4 What is the difference between "plain" and LUKS format?