#luks2 — Public Fediverse posts

Bind a YubiKey to LUKS2 using systemd-cryptenrol over FIDO2. Store HMAC-SHA256 credentials with PIN and User Presence checks in a LUKS2 keyslot.

#linux #luks2 #fido2

https://www.valtersit.com/vault/enrolling-hardware-security-keys-via-fido2-to-luks2-encrypti-b468ed/

Dadurch sollte es einfacher sein, das Betriebssystem und die gesamte Software neu zu installieren, ohne meine persönlichen Einstellungen und Daten zu verlieren.

Da ich meine Festplatte mit #LUKS2 #LUKS verschlüsseln wollte, musste ich das System neu installieren. Die Verschlüsselung war mir wichtig, weil ich den Laptop mit meiner #Nextcloud synchronisieren möchte.

..... weiter 2/5

Am trying to move my daily driver laptop over to #luks #luks2 encryption with a re-installation of nixos. I have persistence set up already and it runs on a flake. So how hard can it be to remove the state data and just re-install #nixos using its flake? Using LLM as the tooling to make bash scripts to do this... and it seems like a mega hoo-ha. Any known easy ways of doing this?

Xubuntu 26.04 LTS (beta) - Installation with FDE failed. The preconfigured encrypted setup option, failed with Python arguments errors. And manually configured and partitioned setup failed, because it did not detect device mapped root correctly -> not possible to install on it. Let’s hope the final version fixes these both annoying issues. I did update the installer with latest version just before running the install, so the image had even older installer, which I didn’t use. #Xubuntu #LTS #LUKS2 #FDE #fail #installation #Linux

I realized #LUKS2 never worked for me because I maintained my /boot inside an encrypted #BTRFS volume alongside /, /home, etc.

This week has been full of major improvements to my #Linux setup across my #ThinkPads. I now have:
1. Significantly faster boot times due to quicker #LUKS decryption by separating out #boot and #EFI into separate volumes.
2. Upgrade from #LUKS1 to #LUKS2 (while most of the rest of my setup)
3. Better visuals for LUKS passphrase prompts using (finally) #plymouth

I couldn't have asked for more improvements in barely two days.

Gut, dass es #TestDisk gibt: Jemand überschrieb versehentlich eine Partitionstabelle (GPT). Darauf befand sich nur eine #LUKS2-Partition. Mit #TestDisk ließ sich das zum Glück regeln.

Aber ganz trivial war es dann doch nicht: TestDisk erkennt nur die Minimalgröße von LUKS-Partitionen und stellt diese wieder her und kennt nicht das tatsächliche Ende. Und entschlüsseln ließ sich das Ding auch nicht: "Invalid argument" nach korrekter Angabe des Schlüssels.

Stellt sich raus: Die Partitionsgröße muss ein Vielfaches der Sektorgröße (hier 4096) sein, sonst geht da gar nix. Also auf die nächstgrößere Partitionsgröße mit parted erweitert und dann gings. :awesome:

#Linux #Encryption #LUKS

Microsoft gerät in die Datenschutzkritik: Der Konzern soll BitLocker-Schlüssel an das FBI weitergegeben haben – mit Folgen für das Vertrauen in Cloud-Sicherheit 🔐🇺🇸 Mehr dazu: https://www.golem.de/news/datenschutzdebatte-microsoft-gibt-bitlocker-schluessel-an-fbi-weiter-2601-204576.html #Microsoft #BitLocker #Datenschutz #FBI #Newz

Die coolen Kidz nutzen #Linux mit #LUKS2 & #Argon2id

Es gibt auch #Veracrypt statt Bitlocker

https://www.drensec.com/kostenlose-festplattenverschluesselung-fuer-windows-11-mit-veracrypt/

I know probably nobody's gonna care, but support for #Argon2 was finally merged in upstream #grub and I'm so happy. I kinda disliked the fact that we had to rely on downstream patches. Now that it's all upstream, I can setup full disk encryption, including /boot, with #luks2 on my #libreboot #thinkpad

Current progress on my system is installed #nixos with #btrfs and #luks2 oh and I also have a swap file but nothing else really. I tried doing secureboot but I've decided to do it later. As for now I'll have to learn how to govern my Nix lol. This will take a while :ablobcatneon:

So i just tried to install #Debian13 with only one ESP and two #LUKS2 partitions of which one is for swap and other for the OS itself.

And guess what?
The installer error'ed out due to the fact it could not install the #Grub #Bootloader, because i didn't setup a separate partition for `/boot`.
Well i fucking do NOT want grub on my system, I want to use `systemd-boot`!
It doesn't even want to install sd -boot if it can't install grub first!

So once again "up-yours" #Debian....🖕

I finally got my #ArchLinux disk encryption upgraded to #LUKS2. It certainly was a challenge because #grub does not seem to play nicely with it but I did get it to work. Grub has a bug in it where passphrases entered from the keyboard need to use PBDKF2 and key files need to use Argon2id. Once I figured this out, everything worked smoothly.

Arch Linux mit vollständiger Festplattenverschlüsselung

GRUB Bootloader zusammen mit LUKS2 und BTRFS Dateisystem Die Einrichtung von Arch Linux mit vollständiger Festplattenverschlüsselung durch LUKS2 bietet ein hohes Maß an Sicherheit für Benutzerdaten und Systemintegrität. LUKS2 (Linux […]

#arch #btrfs #grub #installation #linux #luks #luks2 #verschlüsselung

https://dirkwouters.de/arch-linux-mit-vollstaendiger-festplattenverschluesselung/

Te lo Enseño y Te lo Cuento,Seguridad física en Linux(TPM2.0, Yubikey, Luks2, clevis ySystemd) [aHAJCrYG0VY]

https://fediverse.tv/w/ogwoyWb9aAxUVo86xcGr5P

Achievement unlocked: used systemd-cryptenroll with a newly-installed TPM2 device in my home server to automatically unlock a LUKS2 container (which contains a ZFS pool). I still need to enable Secure Boot on this machine, but this is progress.

#luks2 #systemd #zfs

New: Encryption with LUKS2 when installing from ISO image

Read more: https://www.tuxedocomputers.com/en/New-ISO-Image-for-TUXEDO-OS-with-encryption.tuxedo

#news #encryption #installation #ISO #luks2 #linux #linuxuser

Linux Weekly Roundup: EndeavourOS Galileo with KDE, Rocky Linux 9.3 Updates, Proxmox VE 8.1 Enhancements, and More!
#EndeavourOS #RockyLinux #Proxmox #FreeBSD #OpenMandriva #KDE #LUKS2 #Calamares #SecureBoot #CephReef #OpenSSH #Plasma
https://linuxtldr.com/weekly-roundup/

#Tails 5.14 Ships with Automatic Migration to #LUKS2 :linux: 🔒

https://linuxiac.com/tails-5-14-ships-with-automatic-migration-to-luks2/

#Tails 5.13 Enables #LUKS2 by Default for Persistent Storage and Encrypted Volumes. :linux: 🔒

https://9to5linux.com/tails-5-13-enables-luks2-by-default-for-persistent-storage-and-encrypted-volumes

@downey

As you mentioned reencrypt, that's about encrypting existing data? Then maybe this #RHEL guide helps:
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/security_hardening/encrypting-block-devices-using-luks_security-hardening#encrypting-existing-data-on-a-block-device-using-luks2_encrypting-block-devices-using-luks

Or just have a complete backup (you should anyway), wipe, create a #LUKS2 partition and possibly #LVM on it and restore..

It seems my #GRUB understands both argon2i and argon2id now… #cryptodisk #luks2

@mjg59

Thank you for sounding the alert!

I identified a minor issue with your otherwise nice explanation: According to my sources (man cryptsetup, #rfc9106), all #argon2 varieties are memory-hard. RFC 9106 is even titled “Argon2 Memory-Hard Function for Password Hashing and Proof-of-Work Applications”.

However, given that there are known attacks against #argon2i, it seems wise to use #argon2id instead. It is also what is recommended in the RFC.

As a #QubesOS user, I just checked the state of affairs there:

The cryptsetup that comes with QubesOS 3.x used #luks1, and those who did an in-place upgrade to 4.x still have that unless they converted to #luks2 manually (as detailed in the migration guide).

The cryptsetup in QubesOS 4.x uses #luks2, but it still defaults to #argon2i unfortunately.