Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

WiP: Generate diceware passphrases in oem-factory-reset, output qr code of configured secrets prior of reboot #1850

Open
wants to merge 6 commits into
base: master
Choose a base branch
from
Open

WiP: Generate diceware passphrases in oem-factory-reset, output qr code of configured secrets prior of reboot #1850

wants to merge 6 commits into from

Commits on Nov 21, 2024

  1. diceware: add short list v2, requiring 4 dices and providing longer w… 

    …ords then short list v1 for easier to remember passphrases

This lists comes from https://www.eff.org/files/2016/09/08/eff_short_wordlist_2_0.txt
Refered in article: https://www.eff.org/dice

Signed-off-by: Thierry Laurion <[email protected]>
    @tlaurion
    tlaurion committed Nov 21, 2024
    Configuration menu
    Copy the full SHA
    b00ae01 View commit details
    Browse the repository at this point in the history

  2. initrd/etc/functions: add generate_passphrase logic 

    Nothing uses it for the moment, needs to be called from recovery shell: bash, source /etc/functions. generate_passphrase

- parses dictionary to check how many dice rolls needed on first entry, defaults to EFF short list v2 (bigger words easier to remember, 4 dices roll instead of 5)
  - defaults to using initrd/etc/diceware_dictionnaries/eff_short_wordlist_2_0.txt, parametrable
  - make sure format of dictionary is 'digit word' and fail early otherwise: we expect EFF diceware format dictionaries
- enforces max length of 256 chars, parametrable, reduces number of words to fit if not override
- enforces default 3 words passphrase, parametrable
- enforces captialization of first letter, lowercase parametrable
- read multiple bytes from /dev/urandom to fit number of dice rolls

Unrelated: uniformize format of file

Signed-off-by: Thierry Laurion <[email protected]>
    @tlaurion
    tlaurion committed Nov 21, 2024
    Configuration menu
    Copy the full SHA
    9ecbc0a View commit details
    Browse the repository at this point in the history

  3. WiP initrd/bin/oem-factory-reset: format unification 

    Signed-off-by: Thierry Laurion <[email protected]>
    @tlaurion
    tlaurion committed Nov 21, 2024
    Configuration menu
    Copy the full SHA
    5133f10 View commit details
    Browse the repository at this point in the history

  4. WiP initrd/bin/oem-factory-reset: add --mode (oem/user) skeleton 

    Signed-off-by: Thierry Laurion <[email protected]>
    @tlaurion
    tlaurion committed Nov 21, 2024
    Configuration menu
    Copy the full SHA
    794acce View commit details
    Browse the repository at this point in the history

  5. /etc/functions:: reuse detect_boot_device instead of trying only to m… 

    …ount /etc/fstab existing /boot partition (otherwise early 'o' to enter oem mode of oem-factory-reset

Signed-off-by: Thierry Laurion <[email protected]>
    @tlaurion
    tlaurion committed Nov 21, 2024
    Configuration menu
    Copy the full SHA
    cd5d31c View commit details
    Browse the repository at this point in the history

  6. WiP initrd/bin/oem-factory-reset: add qrcode+secet output loop until … 

    …user press y (end of reownership wizard secret output)

Signed-off-by: Thierry Laurion <[email protected]>

works:
- oem and user mode passphrase generation
- qrcode

missing:
- unattended
  - luks reencryption + passphrase change for OEM mode (only input to be provided) with SINGLE passphrase when in unattended mode
    - same for user reownership when previously OEM reset unattended

Signed-off-by: Thierry Laurion <[email protected]>
    @tlaurion
    tlaurion committed Nov 21, 2024
    Configuration menu
    Copy the full SHA
    b681574 View commit details
    Browse the repository at this point in the history