LinuxQuestions.org
Review your favorite Linux distribution.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices


Reply
  Search this Thread
Old 04-11-2014, 09:17 AM   #1
AnalBeard
Member
 
Registered: Aug 2010
Distribution: Ubuntu 13.04 Server
Posts: 31

Rep: Reputation: 0
encrypted second partition needing more than 1 key to unlock


I'm trying to create an encrypted partition on a server which requires two passphrases from a pool of 4 to unlock - all keys can work together. The idea being the disk is usually unmounted unless we want to gain access, then two people can use their keys to unlock it - it must be a combination of any two though otherwise it defeats the object. Additionally, these two people can be at different locations and accessing the box via SSH.

Is this possible?
 
Old 04-12-2014, 06:45 PM   #2
sag47
Senior Member
 
Registered: Sep 2009
Location: Raleigh, NC
Distribution: Ubuntu, PopOS, Raspbian
Posts: 1,899
Blog Entries: 36

Rep: Reputation: 477Reputation: 477Reputation: 477Reputation: 477Reputation: 477
In short "no"... primarily because encrypted partitions use symmetric encryption which uses a single key (i.e. one key to decrypt and encrypt) and you can't have two keys at once....

However, you can treat the key to the encrypted partition as a "session key" (similar in concept to PGP) in which you encrypt it using the RSA keys of your intended "key holders". What you describe is a bit more tricky though because what I described allows any one of the multiple keys to decrypt the session key. In your case you would need to encrypt the session key multiple times with said keys.

For example, one person decrypts the first stage, and the second person takes the output from the first person and uses their RSA key to decrypt the session key. This can get kind of messy though.

What is the problem you're trying to solve? It sounds pretty edge case and unique.
 
Old 04-13-2014, 03:34 AM   #3
AnalBeard
Member
 
Registered: Aug 2010
Distribution: Ubuntu 13.04 Server
Posts: 31

Original Poster
Rep: Reputation: 0
Quote:
Originally Posted by sag47 View Post
In short "no"... primarily because encrypted partitions use symmetric encryption which uses a single key (i.e. one key to decrypt and encrypt) and you can't have two keys at once....

However, you can treat the key to the encrypted partition as a "session key" (similar in concept to PGP) in which you encrypt it using the RSA keys of your intended "key holders". What you describe is a bit more tricky though because what I described allows any one of the multiple keys to decrypt the session key. In your case you would need to encrypt the session key multiple times with said keys.

For example, one person decrypts the first stage, and the second person takes the output from the first person and uses their RSA key to decrypt the session key. This can get kind of messy though.

What is the problem you're trying to solve? It sounds pretty edge case and unique.
Right, this sounds like it's getting far messier than I want. It's a proof of concept more than anything else - it's basically secure storage of a few files on a remote server which won't be accessed often. The reason for requiring two keys is for security - we don't want anyone to gain access to the files by themselves, for security reasons there needs to be two people involved. Obviously this doesn't rule out collusion, but it makes it that much harder to gain access to the files if you want to do something nefarious/malicious.

Is there any other way you can think of which would achieve roughly the same purpose?
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] Unlock LUKS encrypted partition with USB drive yenn Slackware 4 02-26-2013 04:39 PM
changing a LUKS encrypted partition's key Cultist Slackware 1 03-20-2012 12:13 PM
Howto automount an encrypted partition over ssh using key pair authentication DutchNyko Linux - Security 2 11-05-2011 02:26 AM
[SOLVED] How to unlock (Luks) encrypted root, during boot, when key-file is on USB?? pizzar0 Slackware 2 10-22-2011 07:14 AM
encrypted filesystem with apache needing access stoffell Linux - Security 1 10-14-2003 10:21 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Server

All times are GMT -5. The time now is 05:16 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration