Bug#370302: [Pkg-cryptsetup-devel] Bug#370302: a better recommendation for cryptdisks.functions

[General Stone]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> Why not change the semantics of /etc/crypttab so that the third column
> (keyfile) is interpreted as a script if the file exists and has the
> executable bit set.

This sounds ok

> If so, the script is executed and its stdout is
> piped to cryptsetup via stdin.

This sounds not ok, because if there is a key which needs to decrypt,
the decrypted key needs to save on a location during the process by
an own decrypt-script. You can see that it anyway must save. The
cryptdisks initscript are under the mountdevsubfs.sh initscript which
mount a tmpfs on "/dev/shm" (ah, I have linked it to /tmp). So the FS is
in the Memory (RAM) and I don't know any technics do restore any dates
from it. But the main problem is that anybody can have a key whith
'newlines' and that would not work with the getpass() function in
cryptsetup.

I know that my patch is not perfect but it can be an alternative while
an encryption and decryption for very long keys is implement in
cryptsetup self, so that nobody need gnupg or openssl.


PS: The ../examples/gen-ssl-key is not so intelligent (I know I have
    wrote it ;-), because the generated key have x<30<x standard
    characters (-----BEGIN DSA PRIVATE KEY-----). So a key-size from 128
    bit is reduced to x<98<x bit. In the attachment is a better
    replacment for example.


- - Markus Nass

- --
Key fingerprint = DC3C 257C 2B71 8FA4 F609  F7F7 7C14 F806 5665 77FD

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Was nicht fliegen kann, kann auch nicht abstürzen.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFEhz6ffBT4BlZld/0RAlPHAKCpjLlskYeuoZIq+iq1Hht4CRyc9QCeOp8t
9T64NeQcl+48qVzZVSi3+Zk=
=vseS
-----END PGP SIGNATURE-----
-------------- next part --------------
#!/bin/sh
#
# script to generate a keyfile that is encrypted twice with openssl
#
# Written 2005 by Markus Nass <generalstone at gmx.net>
# Improved 2006 by Jonas Meurer <jonas at freesources.org>

usage() {
  echo "Usage: $0 <key>"
  exit 1
}

if [ "$1" = "" -o "$1" = "-h" -o "$1" = "--help" ]; then
  usage
fi

if [ -x /usr/bin/openssl ]; then
	key=`tempfile`
	dd if=/dev/random of=$key bs=1c count=256
	openssl enc -aes-256-cbc -e -salt -in $key -out $1
	rm -f $key
else
	echo "You have openssl installed?" && exit 1
fi
-------------- next part --------------
A non-text attachment was scrubbed...
Name: decrypt_ssl.sh
Type: application/x-sh
Size: 487 bytes
Desc: not available
Url : http://lists.alioth.debian.org/pipermail/pkg-cryptsetup-devel/attachments/20060607/41cd8556/decrypt_ssl.sh