Skip to content

cryptsetup: add support for unlocking cryptsetup volumes via FIDO2 + TPM2 + add systemd-cryptenroll tool + more - #17741

Merged
poettering merged 30 commits into
systemd:masterfrom
poettering:cryptsetup-fido2
Dec 17, 2020
Merged

cryptsetup: add support for unlocking cryptsetup volumes via FIDO2 + TPM2 + add systemd-cryptenroll tool + more#17741
poettering merged 30 commits into
systemd:masterfrom
poettering:cryptsetup-fido2

Conversation

@poettering

@poettering poettering commented Nov 26, 2020 •
edited
Loading

Copy link
Copy Markdown
Member

This adds five things:

  1. Adds support for unlocking encrypted volumes via FIDO2 security tokens that implement HMAC-SECRET (previously this was already available in homed, this adds it for /etc/crypttab volumes), e.g. YubiKeys
  2. Adds support for unlocking encrypted volumes via TPM2 security chips
  3. This adds a tool "systemd-cryptenroll" that is supposed to accompany "systemd-cryptsetup" and can enroll FIDO2, PKCS#11, TPM2 keys in a user friendly fashion, in a single operation
  4. This improvides PKCS#11 support in cryptsetup so that the encrypted key and PKCS#11 URI can be embedded in the JSON metadata of LUKS2 volumes, making configuration a ton simpler. "systemd-cryptenroll" sets things up automatically like that, which means, setting up PKCS#11 unlocking is now as easy as "systemd-cryptenroll --pkcs11-uri=auto /dev/sda5" and adding pkcs11-uri=auto to the crypttab options of the device. (Similar logic is also done for FIDO2 support, making it equallty easy to use).
  5. The libfido2 dep is now a dlopen() one
  6. "systemd-repart" may now enroll LUKS2 encrypted partitions it creates directly to TPM2. Usecase: boot up image for first time and your /var is freshly initialized, encrypted, to your own TPM2

@poettering
poettering marked this pull request as draft November 26, 2020 14:22
@poettering poettering changed the title cryptsetup: add support for unlocking cryptsetup volumes via FIDO2 + add systemd-cryptenroll tool WIP: cryptsetup: add support for unlocking cryptsetup volumes via FIDO2 + add systemd-cryptenroll tool Nov 26, 2020
@poettering

poettering commented Nov 26, 2020

Copy link
Copy Markdown
Member Author

This is based on top of #17524 btw, and includes its commits as long as that one is not merged.

@poettering poettering changed the title WIP: cryptsetup: add support for unlocking cryptsetup volumes via FIDO2 + add systemd-cryptenroll tool WIP: cryptsetup: add support for unlocking cryptsetup volumes via FIDO2 + TPM2 + add systemd-cryptenroll tool + more Nov 28, 2020
@poettering
poettering force-pushed the cryptsetup-fido2 branch 2 times, most recently from db5b235 to f1f096d Compare December 1, 2020 13:05
@poettering poettering mentioned this pull request Dec 1, 2020
Merged
@poettering
poettering force-pushed the cryptsetup-fido2 branch 3 times, most recently from 704624f to 03de19f Compare December 4, 2020 09:29
@poettering poettering mentioned this pull request Dec 4, 2020
Closed
@poettering
poettering force-pushed the cryptsetup-fido2 branch 4 times, most recently from e3ab11b to deac4a4 Compare December 7, 2020 12:40
bluca
bluca reviewed Dec 7, 2020
View reviewed changes
Comment thread src/shared/openssl-util.c Outdated
bluca
bluca reviewed Dec 7, 2020
View reviewed changes
Comment thread src/shared/cryptsetup-util.h Outdated
@poettering
poettering force-pushed the cryptsetup-fido2 branch 4 times, most recently from 982b82a to 41b99bd Compare December 8, 2020 21:54
@poettering poettering changed the title WIP: cryptsetup: add support for unlocking cryptsetup volumes via FIDO2 + TPM2 + add systemd-cryptenroll tool + more cryptsetup: add support for unlocking cryptsetup volumes via FIDO2 + TPM2 + add systemd-cryptenroll tool + more Dec 8, 2020
@poettering
poettering marked this pull request as ready for review December 8, 2020 21:55
@poettering
poettering force-pushed the cryptsetup-fido2 branch 3 times, most recently from 46e8937 to a7e6c36 Compare December 9, 2020 10:08
@bluca

bluca commented Dec 9, 2020

Copy link
Copy Markdown
Member

#17884 should get merged soon, once that happens please rebase and add libfido2 to the test as well

bluca
bluca reviewed Dec 9, 2020
View reviewed changes
Comment thread src/shared/libfido2-util.c Outdated
@poettering
homed: move fido2 setup code to src/shared/
17599e1 
That way we can reuse it from systemd-cryptenroll
@poettering
homed: split out HMAC-HASH fido2 decode code into src/shared/
ebcb3f3 
That way we can use it later on in systemd-cryptsetup to unlock devices
with FIDO2 tokens.
@poettering
fido2: don't use up/uv/rk when device doesn't support it
e3fb662 
Apparently devices are supposed to generate failures if we try to turn
off features they don't have. Thus don't.

Prompted-by: systemd#17784 (comment)
@poettering
cryptsetup: add fido2 support
2bc5c42
@poettering
cryptenroll: add new "systemd-cryptenroll" tool for enrolling FIDO2+P…
8710a68 
…KCS#11 security tokens
@poettering
sort-util: make cmp_int() generic, so that we can reuse it elsewhere
1403d48
@poettering
json: add APIs for quickly inserting hex blobs into as JSON strings
2d64d2b 
This is similar to the base64 support, but fixed-size hash values are
typically preferably presented as series of hex values, hence store them
here like that too.
@poettering
cryptenroll: add support for TPM2 enrolling
5e52162
@poettering
cryptenroll: support listing and wiping tokens
d2fafc4
@poettering
cryptsetup: add support for TPM2 unlocking of volumes
18843ec
@poettering
string-table: add private version of lookup macro with boolean fallback
5f0ab16
@poettering
repart: optionally lock encrypted partitions to TPM2
889914e 
This useful for bootstrapping encrypted systems: on first boot let's
create a /var/ partition that is locked to the local TPM2.
@poettering
test: add tpm2 and fido2 libs to dlopen test
a60d5b2
@poettering
fido2: when listing fido2/hmac-secret devices, actually validate feat…
1abaa19 
…ure set
@poettering
man: document new features
cf1e172
@poettering
mkosi: add TPM2 packages to debian/ubuntu/fedora mkosi files
5e85016 
As suggested: systemd#17741 (comment)
@poettering
update TODO
80670e7
@poettering

poettering commented Dec 17, 2020

Copy link
Copy Markdown
Member Author

New version posted with the debian/ubuntu mkosi file updated as suggested. no other changes. let's see if this works this time

@bluca bluca added good-to-merge/waiting-for-ci 👍 PR is good to merge, but CI hasn't passed at time of review. Please merge if you see CI has passed and removed documentation good-to-merge/with-minor-suggestions meson labels Dec 17, 2020
@poettering
poettering merged commit 5cd35a1 into systemd:master Dec 17, 2020
@gdamjan

gdamjan commented Dec 24, 2020 •
edited
Loading

Copy link
Copy Markdown
Contributor

I've also tested this on Archlinux to unlock my / and /home LUKS devices. On top of the standard LUKS configuration, the initramfs will need some additional configuration. For my machine¹, this is what I have in /etc/mkinitcpio.conf:

MODULES=('tpm_crb')

BINARIES=(
  /usr/lib/libtss2-esys.so.0
  /usr/lib/libtss2-mu.so.0
  /usr/lib/libtss2-rc.so.0
  /usr/lib/libtss2-tcti-device.so.0
)

HOOKS=(base systemd autodetect modconf block sd-encrypt filesystems keyboard fsck)

These dependencies can't be automatically discovered (for now), since systemd-cryptsetup is using dlopen to load the libraries. Make sure to use the systemd/sd-encrypt mkinitcpio HOOKs.

¹ I'm using the AMD fTPM (on a Ryzen 5 3600 cpu and MSI B550m motherboard).

@L0g4n

L0g4n commented Apr 2, 2021 •
edited
Loading

Copy link
Copy Markdown

@gdamjan
So I followed the instructions from poettering blog post to do this on arch (FOR a fido2 token). However, after adding the device to etc/crypttab and regenerating the initramfs it still asks me for my passphrase at boot time. So I think I am missing something in my etc/mkinitcpio.conf.

MODULES=(amdgpu)
BINARIES=()
HOOKS=(base systemd autodetect keyboard sd-vconsole modconf block sd-encrypt lvm2 filesystems fsck)

Basically I ran systemd-cryptenroll --fido2-device=auto /dev/sdb2 and placed cryptlvm /dev/sdb2 - fido2-device=auto in my etc/crypttab.

Do you happen to know what modifications are needed in the initramfs config for FIDO2 tokens?

@gdamjan

gdamjan commented Apr 2, 2021

Copy link
Copy Markdown
Contributor

@L0g4n let's take this to the Arch forum or to the systemd irc

@L0g4n

L0g4n commented Apr 2, 2021

Copy link
Copy Markdown

@gdamjan Sure. I opened a topic: https://bbs.archlinux.org/viewtopic.php?pid=1965601#p1965601

@bluca bluca mentioned this pull request Jun 1, 2021
Merged
@klausenbusk klausenbusk mentioned this pull request Sep 15, 2021
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bluca bluca bluca left review comments
+1 more reviewer
@gdamjan gdamjan gdamjan left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

cryptsetup good-to-merge/waiting-for-ci 👍 PR is good to merge, but CI hasn't passed at time of review. Please merge if you see CI has passed

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@poettering @bluca @gdamjan @L0g4n