Homelab

2425 readers

4 users here now

Rules

Be Civil.
Post about your homelab, discussion of your homelab, questions you may have, or general discussion about transition your skill from the homelab to the workplace.
No memes or potato images.
We love detailed homelab builds, especially network diagrams!
Report any posts that you feel should be brought to our attention.
Please no shitposting or blogspam.
No Referral Linking.
Keep piracy discussion off of this community

founded 2 years ago

MODERATORS

communick@selfhosted.forum

rglullis

Unlocking LUKS with NitroKey/Yubikey: FIDO2, HMAC-SHA1, or OpenPGP? (thebrainbin.org)

submitted 1 month ago by modem_down@thebrainbin.org to c/homelab@selfhosted.forum

4 comments fedilink hide all child comments

Crossposted from https://thebrainbin.org/m/linux@lemmy.ml/t/1840283

Which approach do you think is better, and why?

FIDO2

HMAC-SHA1

OpenPGP (alternative guide)

Or do you think there is an even better way to use a hardware security token to unlock drives having LUKS full disk encryption?

you are viewing a single comment's thread
view the rest of the comments

[–] k8sgremlin@geekroom.tech 2 points 4 weeks ago

If you're on anything with a reasonably current systemd (248+, so basically any Debian 12/Fedora/Arch box), FIDO2 via systemd-cryptenroll is the one I'd reach for first, no extra daemons, actively maintained since it's just systemd itself.

HMAC-SHA1 (yubikey-luks project) is the most battle-tested of the three, but it's a third-party keyscript hook with spottier maintenance over the years. The SHA1 part isn't actually a security weakness here since it's HMAC challenge-response, not collision resistance, so don't let the algorithm name scare you off it.

OpenPGP-on-Nitrokey is the heaviest of the three (needs gpg/scdaemon alive in initramfs), but worth it if you're already using the OpenPGP applet for SSH auth or email signing.

I run FIDO2 with a TPM2 enrollment as fallback so a lost key doesn't lock me out entirely.