Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

is it possible to create a crypted partition with a two-factor authentication ( decryption with password and keyfile ) with LUKS, like in truecrypt?

share|improve this question

3 Answers 3

I'm sorry no one has previously answered your question. If you are still interested, no it is not currently possible; the only way you can make your key more secure is one of the below.

  • You can use a "one-time key" that is changed at each startup. These keys are usually created by reading /dev/Xrandom during dm-crypt setup. No key is stored this way and no passphrase needed, but this method can only be used on filesystems that can be formated at each reboot (like swap or maybe /tmp if you do not want to retain the information stored there). Using suspend to disk will be impossible with one-time keys used on the swap device.

  • You can store the key on removable storage. That way it is only accessible when needed. Your data is in the open when the storage is stolen or copied.

  • You can generate a hash value (== a pseudorandom number) from a keyphrase and use that as a key. The key is not stored on media that way at all, but you can not change the passphrase (a different key is generated then). All people with access to the encrypted data need to know this passphrase. This is a bit impractical in a multi user environment.

  • You can encrypt the key. The encrypted key is stored on the computer with the encrypted device. You can change the passphrase by
    reencrypting the key with a different one and you can have several copies of the same key encrypted for several people.

  • You can encrypt the key and store it on a removeable media.

  • You can use smartcards etc. This is the most secure option.

share|improve this answer

I haven't tried it myself yet, but you could use a Yubikey, configured to hold static password (up to 38-characters) in the second slot (first slot is OTP which you'd want to keep for use with a password manager).

In theory, you would type in your shorter, easy to remember, pass phrase and then append it with the static password from a Yubikey. Since the Yubikey looks like a USB HID you shouldn't have a problem using it as long as USB keyboard support is enabled in the BIOS.

share|improve this answer

Look at this, my be what you want https://www.masarlabs.com/article/two-factor-luks-decription/

share|improve this answer
    
Welcome to Ask Ubuntu! Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. –  fossfreedom Apr 26 '13 at 11:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.