Integrate 2FA/YubiKey into LUKS

[rugk]

It would be nice if you could integrate the 2FA/YubiKey into luks.

See these instructions and this site e.g.

[andrewdavidwong]

Related: #1979

[andrewdavidwong]

Related: #1979

[Joeviocoe]

Qubes doesn't just run on Laptops. Think about Desktops. They require USB Keyboards since most modern desktop systems don't have PS/2. And since they require USB Keyboards to enter the LUKS Passphrase, that means the "rd.qubes.hide_all_usb" option in the bootloader will render the whole system inaccessible. So USB security at boot time is not an option, therefore, not a tradeoff with 2FA for LUKS.

2FA means that I don't have to weaken my passphrase so its memorable. And if snooped by some Evil Maid attack methods, they'll need to pull the token from my cold dead hands too. AEM for Qubes only works with USB storage, not Yubikey Challenge/Response, and still requires a TPM which desktops don't often have.

I am hoping someone will finish this idea and make it available, especially for desktop users with yubikey.
Unfortunately, I don't have much knowledge on initramfs or dracut to produce something usable myself. I have searched all over, and only find the same abandoned ideas, or directions to using Yubikey for something other than LUKS, or on a Debian based system.

Please help.
Thank you.

[Joeviocoe]

Qubes doesn't just run on Laptops. Think about Desktops. They require USB Keyboards since most modern desktop systems don't have PS/2. And since they require USB Keyboards to enter the LUKS Passphrase, that means the "rd.qubes.hide_all_usb" option in the bootloader will render the whole system inaccessible. So USB security at boot time is not an option, therefore, not a tradeoff with 2FA for LUKS.

2FA means that I don't have to weaken my passphrase so its memorable. And if snooped by some Evil Maid attack methods, they'll need to pull the token from my cold dead hands too. AEM for Qubes only works with USB storage, not Yubikey Challenge/Response, and still requires a TPM which desktops don't often have.

I am hoping someone will finish this idea and make it available, especially for desktop users with yubikey.
Unfortunately, I don't have much knowledge on initramfs or dracut to produce something usable myself. I have searched all over, and only find the same abandoned ideas, or directions to using Yubikey for something other than LUKS, or on a Debian based system.

Please help.
Thank you.

[marmarek]

More discussion, including PoC: https://groups.google.com/d/msgid/qubes-users/5a377fe7-833f-4c53-ab31-66a2c0f667a0%40googlegroups.com

[marmarek]

More discussion, including PoC: https://groups.google.com/d/msgid/qubes-users/5a377fe7-833f-4c53-ab31-66a2c0f667a0%40googlegroups.com