74 lines
2.6 KiB
Diff
74 lines
2.6 KiB
Diff
|
--- clevis-15.ori/src/clevis.1.adoc 2020-10-28 19:55:47.663228800 +0100
|
||
|
|
+++ clevis-15/src/clevis.1.adoc 2023-01-11 17:18:29.967295005 +0100
|
||
|
|
@@ -101,7 +101,7 @@
|
||
|
|
|
||
|
|
This command performs four steps:
|
||
|
|
|
||
|
|
-1. Creates a new key with the same entropy as the LUKS master key.
|
||
|
|
+1. Creates a new key with the same entropy as the LUKS master key -- maximum entropy bits is 256.
|
||
|
|
2. Encrypts the new key with Clevis.
|
||
|
|
3. Stores the Clevis JWE in the LUKS header.
|
||
|
|
4. Enables the new key for use with LUKS.
|
||
|
|
--- clevis-15.ori/src/luks/clevis-luks-bind.1.adoc 2020-10-28 19:55:47.663228800 +0100
|
||
|
|
+++ clevis-15/src/luks/clevis-luks-bind.1.adoc 2023-01-11 17:18:55.239351209 +0100
|
||
|
|
@@ -20,7 +20,7 @@
|
||
|
|
|
||
|
|
This command performs four steps:
|
||
|
|
|
||
|
|
-1. Creates a new key with the same entropy as the LUKS master key.
|
||
|
|
+1. Creates a new key with the same entropy as the LUKS master key -- maximum entropy bits is 256.
|
||
|
|
2. Encrypts the new key with Clevis.
|
||
|
|
3. Stores the Clevis JWE in the LUKS header.
|
||
|
|
4. Enables the new key for use with LUKS.
|
||
|
|
--- clevis-15.ori/src/luks/clevis-luks-common-functions 2023-01-11 17:15:44.984928070 +0100
|
||
|
|
+++ clevis-15/src/luks/clevis-luks-common-functions 2023-01-11 17:20:53.238613637 +0100
|
||
|
|
@@ -865,6 +865,7 @@
|
||
|
|
[ -z "${DEV}" ] && return 1
|
||
|
|
|
||
|
|
local dump filter bits
|
||
|
|
+ local MAX_ENTROPY_BITS=256
|
||
|
|
dump=$(cryptsetup luksDump "${DEV}")
|
||
|
|
if cryptsetup isLuks --type luks1 "${DEV}"; then
|
||
|
|
filter="$(echo "${dump}" | sed -rn 's|MK bits:[ \t]*([0-9]+)|\1|p')"
|
||
|
|
@@ -876,6 +877,9 @@
|
||
|
|
fi
|
||
|
|
|
||
|
|
bits="$(echo -n "${filter}" | sort -n | tail -n 1)"
|
||
|
|
+ if [ "${bits}" -gt "${MAX_ENTROPY_BITS}" ]; then
|
||
|
|
+ bits="${MAX_ENTROPY_BITS}"
|
||
|
|
+ fi
|
||
|
|
pwmake "${bits}"
|
||
|
|
}
|
||
|
|
|
||
|
|
--- clevis-15.ori/src/luks/clevis-luks-bind.in 2023-01-11 17:15:44.815927694 +0100
|
||
|
|
+++ clevis-15/src/luks/clevis-luks-bind.in 2023-01-12 16:20:30.266404993 +0100
|
||
|
|
@@ -19,6 +19,8 @@
|
||
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||
|
|
#
|
||
|
|
|
||
|
|
+. clevis-luks-common-functions
|
||
|
|
+
|
||
|
|
SUMMARY="Binds a LUKS device using the specified policy"
|
||
|
|
UUID=cb6e8904-81ff-40da-a84a-07ab9ab5715e
|
||
|
|
|
||
|
|
@@ -139,14 +141,11 @@
|
||
|
|
fi
|
||
|
|
|
||
|
|
# Generate a key with the same entropy as the LUKS Master Key
|
||
|
|
-key="$(pwmake "$(
|
||
|
|
-cryptsetup luksDump "$DEV" \
|
||
|
|
- | if [ "$luks_type" == "luks1" ]; then
|
||
|
|
- sed -rn 's|MK bits:[ \t]*([0-9]+)|\1|p'
|
||
|
|
- else
|
||
|
|
- sed -rn 's|^\s+Key:\s+([0-9]+) bits\s*$|\1|p'
|
||
|
|
- fi | sort -n | tail -n 1
|
||
|
|
-)")"
|
||
|
|
+if ! key="$(clevis_luks_generate_key "${DEV}")" \
|
||
|
|
+ || [ -z "${key}" ]; then
|
||
|
|
+ echo "Unable to generate key for ${DEV}" >&2
|
||
|
|
+ return 1
|
||
|
|
+fi
|
||
|
|
|
||
|
|
# Encrypt the new key
|
||
|
|
jwe="$(echo -n "$key" | clevis encrypt "$PIN" "$CFG" "${YES}")"
|