Moritz Maxeiner 407a770161 Rewrite as a pre-boot authentication module (mostly) comforming to the design specification of ... 'YubiKey Integration for Full Disk Encryption Pre-Boot Authentication (Copyright) Yubico, 2011 Version: 1.1'. Used binaries: * uuidgen - for generation of random sequence numbers * ykchalresp - for challenging a Yubikey * ykinfo - to check if a Yubikey is plugged in at boot (fallback to passphrase authentication otherwise) * openssl - for calculation of SHA-1, HMAC-SHA-1, as well as AES-256-CTR (de/en)cryption Main differences to the specification mentioned above: * No user management (yet), only one password+yubikey per LUKS device * SHA-512 instead of CRC-16 for checksum Main differences to the previous implementation: * Instead of changing the key slot of the LUKS device each boot, the actual key for the LUKS device will be encrypted itself * Since the response for the new challenge is now calculated locally with openssl, the MITM-USB-attack with which previously an attacker could obtain the new response (that was used as the new encryption key for the LUKS device) by listening to the Yubikey has ideally become useless (as long as uuidgen can successfuly generate new random sequence numbers). Remarks: * This is not downwards compatible to the previous implementation		2014-01-28 04:02:51 +01:00
..
activation	Fix passing of kernel parameters	2013-12-02 11:56:58 -05:00
boot	Rewrite as a pre-boot authentication module (mostly) comforming to the design specification of	2014-01-28 04:02:51 +01:00
etc	Make /etc/localtime a direct symlink to the zoneinfo file	2014-01-06 18:23:41 +01:00
upstart	Remove remaining references to Upstart	2013-10-31 13:26:06 +01:00