Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Encryption: Support directly provided raw or detached master key #808

Open
maxz opened this issue Jan 5, 2025 · 0 comments
Open

Encryption: Support directly provided raw or detached master key #808

maxz opened this issue Jan 5, 2025 · 0 comments

Comments

@maxz
Copy link

maxz commented Jan 5, 2025

Currently the master key is stored in the super block and can be unlocked by a key which is derived from a sequence provided via direct input, file or stdin.

Since the overwriting of sectors can be hard to control (mostly relevant for SSD / flash storage) it would be nice to be able to provide the key directly. It then could be stored on different encrypted media to chain-unlock the bcachefs volume or stored on some detachable device.
Otherwise a master key with a compromised passphrase might remain accessible via the old passphrase, even after changing it.

To my knowledge ChaCha20 keys have no specific key requirements (any cryptographically random sequence of 32 bytes will do) so I see no reason speaking against providing a key directly (except for not being able to tell whether the key is valid, but that's the user's problem for this mode in my view.)
dm-crypt (--key-file=- --hash=plain --type=plain) and ZFS (keyformat=raw keylocation=file://...) support this use case.

I could also live with a master key that is derived from some input, but providing the master key directly would be most desirable.

My least favourite option would be to simply be able to store the encrypted master key in some other location. This would be similar to dm-crypt with LUKS and a detached header.

Are there any plans for such changes yet or is there anything speaking against them?
I think I found wishlist items which are somewhat related like "secure delete" and "support for multiple key slots", although they would not directly cover what I'm looking for.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant