7

is it possible to create an encrypted partition with a two-factor authentication ( decryption with password and keyfile ) with LUKS, like in truecrypt?

Improve this question

4 Answers 4

Reset to default
2

Yes, this is possible. As mentioned by @muldune, you can use a Yubikey to perform 2FA encryption with LUKS. Have a look at my AskUbuntu answer here.

Improve this answer
1

I'm sorry no one has previously answered your question. If you are still interested, no it is not currently possible; the only way you can make your key more secure is one of the below.

  • You can use a "one-time key" that is changed at each startup. These keys are usually created by reading /dev/Xrandom during dm-crypt setup. No key is stored this way and no passphrase needed, but this method can only be used on filesystems that can be formated at each reboot (like swap or maybe /tmp if you do not want to retain the information stored there). Using suspend to disk will be impossible with one-time keys used on the swap device.

  • You can store the key on removable storage. That way it is only accessible when needed. Your data is in the open when the storage is stolen or copied.

  • You can generate a hash value (== a pseudorandom number) from a keyphrase and use that as a key. The key is not stored on media that way at all, but you can not change the passphrase (a different key is generated then). All people with access to the encrypted data need to know this passphrase. This is a bit impractical in a multi user environment.

  • You can encrypt the key. The encrypted key is stored on the computer with the encrypted device. You can change the passphrase by
    reencrypting the key with a different one and you can have several copies of the same key encrypted for several people.

  • You can encrypt the key and store it on a removeable media.

  • You can use smartcards etc. This is the most secure option.

Improve this answer
1

I haven't tried it myself yet, but you could use a Yubikey, configured to hold static password (up to 38-characters) in the second slot (first slot is OTP which you'd want to keep for use with a password manager).

In theory, you would type in your shorter, easy to remember, pass phrase and then append it with the static password from a Yubikey. Since the Yubikey looks like a USB HID you shouldn't have a problem using it as long as USB keyboard support is enabled in the BIOS.

Improve this answer
1
1

Look at this, my be what you want https://www.masarlabs.com/article/two-factor-luks-decription/

Improve this answer
1
  • 1
    Welcome to Ask Ubuntu! Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference.
    – fossfreedom ♦
    Apr 26, 2013 at 11:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .