Use local stored key to manage recovery keys
Open
@derektamsen is already working on this.
Since May 21, 2018.
enhancement
- Dominant language
- Go
- Stars
- 50
- Forks
- 13
- Avg merge
- 27m
- Merged PRs (30d)
- 7
Description
luks2crypt should generate and use a local key to manage the escrowed recovery keys. This would allow luks2crypt to not keep a cleartext cached password locally on the host. It would also enable it to rotate passwords on a scheduled basis.
Ex:
- luks slot 1 would contain a locally generated cert stored in /etc/luks2crypt/adminkey
- luks slot 2 would contain a recovery key. This would then be escrowed an no local copy would be kept.
- luks slot 3+ would be used for user keys.
Luks2crypt would then be able to rotate slot 2 at a scheduled interval or with a cli flag.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.