{"id":119,"date":"2005-04-18T02:31:49","date_gmt":"2005-04-17T23:31:49","guid":{"rendered":"https:\/\/void.gr\/kargig\/blog\/2005\/04\/18\/usb-key-encryption-frenzy\/"},"modified":"2006-10-11T22:27:45","modified_gmt":"2006-10-11T19:27:45","slug":"usb-key-encryption-frenzy","status":"publish","type":"post","link":"https:\/\/www.void.gr\/kargig\/blog\/2005\/04\/18\/usb-key-encryption-frenzy\/","title":{"rendered":"Usb key encryption frenzy, loopfile encryption"},"content":{"rendered":"

It’s time for something more serious now, time to play with encrypted partitions and loop devices storing the keys on the usb key.<\/p>\n

Following the excellent loop-AES.README<\/a> I created an encrypted loop file that is encrypted with some random keys which are stored inside a file…and that file is encrypted with gpg and stored inside my usb stick. Confused ? Here it goes…<\/p>\n

“Create 65 random encryption keys and encrypt those keys using gpg.”
\n# head -c 2925 \/dev\/urandom | uuencode -m - | head -n 66 | tail -n 65| gpg --symmetric -a >\/mnt\/usb-key\/keyfile.gpg<\/code><\/p>\n

Time for the loop file creation. An example of a 100Mb file follows:
\n# dd if=\/dev\/urandom of=\/my-encrypted-loop.aes bs=1k count=100000<\/code><\/p>\n

Then encrypt the loop file using our previously generated keys. From losetup man page:<\/p>\n

-K gpgkey
\n Password is piped to gpg so that gpg can decrypt file gpgkey which
\n contains the real keys that are used to encrypt loop device. If
\n decryption requires public\/private keys and gpghome is not speci-
\n fied, all users use their own gpg public\/private keys to decrypt
\n gpgkey. Decrypted gpgkey should contain 1 or 64 or 65 keys, each
\n key at least 20 characters and separated by newline. If decrypted
\n gpgkey contains 64 or 65 keys, then loop device is put to multi-key
\n mode. In multi-key mode first key is used for first sector, second
\n key for second sector, and so on. 65th key, if present, is used as
\n additional input to MD5 IV computation.\n<\/p><\/blockquote>\n

So…
\n# losetup -K \/mnt\/usb\/keyfile.gpg -e AES256 \/dev\/loop3 \/home\/kargig\/mytest
\n# losetup -d \/dev\/loop3
\n<\/code><\/p>\n

Now add this to \/etc\/fstab:
\n\/my-encrypted-loop.aes \/mnt\/private ext3 defaults,noauto,user,loop=\/dev\/loop3,encryption=AES256,gpgkey=\/mnt\/usb-key\/keyfile.gpg 0 0
\n<\/code><\/p>\n

now try this in order to check if the fstab entry is working and to format the loopfile:
\n# losetup -F \/dev\/loop3
\n# mke2fs -j \/dev\/loop3
\n# losetup -d \/dev\/loop3
\n<\/code><\/p>\n

If everything is fine…you can just try this:<\/p>\n

mount \/mnt\/private<\/code><\/p>\n

And you should be asked for your gpg passphrase \ud83d\ude42 If you don’t have your usb key mounted, the loop file(or partition) won’t be mountable. BACKUP your keyfile.gpg!!!<\/p>\n

What if you want to change your password ? Simply do this to decrypt the gpg file and re-encrypt it with a new password:
\n# gpg -d \/mnt\/usb-key\/keyfile.gpg > \/mnt\/usb-key\/clearkeys.txt
\n# cat \/mnt\/usb-key\/clearkeys.txt | gpg --symmetric -a > \/mnt\/usb-key\/newkeyfile.gpg
\n(now make sure the keyfile.gpg and newkeyfile.gpg differs, if yes it means that the gpg password was changed...move on)
\n# mv \/mnt\/usb-key\/newkeyfile.gpg \/mnt\/usb-key\/keyfile.gpg
\n# rm -f \/mnt\/usb-key\/clearkeys.txt
\n<\/code>
\n(thanks to metown for pointing at some errors at the previous post)<\/p>\n

What’s left to be done now is make it work like the pam_usb module, ie create a set of scripts(or programs?) so that when I want to mount the encrypted partition it will automatically check the usb key to find a private key to check it against the “partition’s public key” so there won’t be a need for typing a passphrase. <\/p>\n","protected":false},"excerpt":{"rendered":"

It’s time for something more serious now, time to play with encrypted partitions and loop devices storing the keys on the usb key. Following the excellent loop-AES.README I created an encrypted loop file that is encrypted with some random keys which are stored inside a file…and that file is encrypted with gpg and stored inside […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"ep_exclude_from_search":false,"footnotes":""},"categories":[1,3],"tags":[],"class_list":["post-119","post","type-post","status-publish","format-standard","hentry","category-general","category-linux"],"aioseo_notices":[],"views":5051,"_links":{"self":[{"href":"https:\/\/www.void.gr\/kargig\/blog\/wp-json\/wp\/v2\/posts\/119","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.void.gr\/kargig\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.void.gr\/kargig\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.void.gr\/kargig\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.void.gr\/kargig\/blog\/wp-json\/wp\/v2\/comments?post=119"}],"version-history":[{"count":0,"href":"https:\/\/www.void.gr\/kargig\/blog\/wp-json\/wp\/v2\/posts\/119\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.void.gr\/kargig\/blog\/wp-json\/wp\/v2\/media?parent=119"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.void.gr\/kargig\/blog\/wp-json\/wp\/v2\/categories?post=119"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.void.gr\/kargig\/blog\/wp-json\/wp\/v2\/tags?post=119"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}