GNU GRUB - Bugs: bug #57678, Add a possibility to transfer...
You are not allowed to post comments on this tracker with your current authentication level.
bug #57678: Add a possibility to transfer passphrase to OS when unlocking encrypted container
Submitter: | Alexander Shchadilov <kadilov> | ||
Submitted: | Mon 27 Jan 2020 02:12:27 PM UTC | ||
Category: | Security | Severity: | Major |
Priority: | 5 - Normal | Item Group: | Feature Request |
Status: | None | Privacy: | Public |
Assigned to: | None | Originator Name: | |
Open/Closed: | Open | Release: | 2.02 |
Release: | Reproducibility: | None | |
Planned Release: | None |
No files currently attached
Depends on the following items: None found
Items that depend on this one: None found
Carbon-Copy List
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follows 1 latest change.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2020-01-27 | kadilov | Carbon-Copy | - | ![]() |
Added kadilov |
Powered by Savane 3.12.
Corresponding source code
Currently using GRUB with GRUB_ENABLE_CRYPTODISK option for unlocking encrypted device may lead to a scenario when user needs to enter passphrase twice, once for GRUB and once for OS booting software. If LUKS is used, a common workaround that improves user experience involves generating a LUKS key that is permanently stored inside the encrypted container.
Having a way to securely transfer the passphrase to OS would make possible a more streamlined configuration.
Workarounds described in community documentation of Linux distributions:
https://wiki.archlinux.org/index.php/Dm-crypt/Device_encryption#With_a_keyfile_embedded_in_the_initramfs
https://en.opensuse.org/SDB:Encrypted_root_file_system
This suggestion was originally posted by Andreas Stieger on openSUSE bug tracker:
https://bugzilla.suse.com/show_bug.cgi?id=1137056#c1