Preservation/kaiten-yaki
1
0
Fork 0
mirror of https://github.com/suikan4github/kaiten-yaki.git synced 2025-12-20 02:21:17 -03:00
Code Issues Projects Releases Packages Wiki Activity Actions

Update the documentation

Browse source
This commit is contained in:
Suikan 2021-07-11 14:31:21 +09:00
parent f1ad8ae660
commit 40972cebaf
4 changed files with 22 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

13
appnote/an02_keyslot.md
View file

@ -6,18 +6,18 @@ On the other hand, some extreme cases like installing distributions as many as p
This application note explains the limitations and difficulties that come from the number of LUKS key slots, and how to overcome that limitation( if possible ).
# The LUKS key slots
The LUKS volume has 8 key slots. That means, up to 8 key hash values can be stored. In other words, the user can use 8 different keys to open a LUKS volume.
The LUKS volume has 8 key slots which can stores one key hash value. In other words, the user can use 8 different keys to open a LUKS volume.
In this context, the "user" is not limited to a human being. Any software can use a passphrase to open a LUKS volume. Thus, even only one person uses a computer, multiple key slots may be used.
If some user ( or software ) feeds a passphrase to open a LUKS volume, the management software ( dm-crypt library ) scans key slots and check whether there is a matching slot or not. If there is a slot in which the stored hash value matches with the hash value of the given passphrase, that passphrase is the right one.
If an user ( or software ) feeds a passphrase to open a LUKS volume, the management software ( dm-crypt library ) scans key slots and check whether there is a matching slot or not. If there is a slot in which the stored hash value matches with the hash value of the given passphrase, that passphrase is the right one.
# How Kaiten-yaki uses the LUKS key slots
Kaiten-yaki uses N+1 LUKS key slots to install the N distributions in a system ( where N is an integer ).
Whenever Kaiten-yaki creates a LUKS volume, it registers a passphrase typed by the user. This passphrase is stored in the key slot 0. So, when the user types his passphrase correctly, its hash will be matched with the hash value in slot 0, by default.
Whenever Kaiten-yaki creates a LUKS volume, it registers a passphrase typed by the user. This passphrase is stored in the key slot 0. So, when the user types his passphrase correctly at boot time, its hash will be matched with the hash value in slot 0, by default.
In addition to the user passphrase, Kaiten-yaki uses one key slot to register the passphrase to open the LUKS volume from the Linux kernel. This passphrase is different from the user passphrase. This passphrase is random binary brock generated by /dev/random. This key is stored in the file under /etc/luks. Even somebody watches its value over the shoulder, the risk is small because it is difficult to ready for a human being.
In addition to the user passphrase, Kaiten-yaki uses one key slot to register the passphrase to let the Linux kernel open the LUKS volume. This passphrase is different from the user passphrase. Actually, this passphrase is random binary brock generated by /dev/random. This key is stored in the file under /etc/luks. Even somebody watches its value over the shoulder of a user, the risk is small because it is difficult to read for a human being.
Anyway, this usage defines the maximum number of Linux installed in a system. That is 7 if all are installed by Kaiten-yaki. If a user try to install the 8th distribution in a LUKS volume with Kaiten-yaki, it will fail because there is no vacant LUKS key slot.
# Overwrite installation
@ -25,14 +25,13 @@ The overwrite installation is another case that consumes a LUKS key slot.
if the variable OVERWITEINSTALL in config.sh is set to 1, Kaiten-yaki just overwrites an existing logical volume in the LUKS volume. Also, in this case, Kaiten-yaki registers a new key file for the new installation. Thus, while the number of the installed Linux is the same, the number of the used LUKS key slot is increased.
Eventually, the user fails to install even the installed Linux is 2 or 3, if there is not vacant LUKS key slot.
Eventually, the user fails to install even the installed Linux is small like 2 or 3, if there is not vacant LUKS key slot.
# Managing key slots
Some users may want to delete a key slot to install another distribution. In this case, they must know which LUKS key slots are used or not.
This section explains how to investigate the used slots.
First of all, user can l
The example of this command is shown below. Slot 0, 1, and 2 are occupied :
First of all, user can list the status of the all LUKS key slots. The example of this command is shown below. Slot 0, 1, and 2 are occupied :
```
takemasa@mate-vm:~$ sudo cryptsetup luksDump /dev/sda2 | grep -i bled
Key Slot 0: ENABLED