[Feature Request] Tang unlock for LUKS encryption

[Handrail9]

It would be cool if sdm Disk Encryption could take advantage of tang. Tang is a server for binding data to network presence. What this would mean for end users is that as long as their Raspberry Pi could connect to their Tang server (which is usually only accessible from an internal/private LAN network) that no user interaction would be needed to unlock the LUKS drive. If the Tang server is not reachable, the drive would need to be manually unlocked via a passphrase or keyfile.

[gitbls]

Looks interesting. Do you have a real use case for it? Would you be able to test it during development?

[Handrail9]

My use case would be for a personal use Pi that would be used purely at home. I currently utilize the keyfile with this device but Tang may be an even easier solution. I would be willing to test in development but I dont want to promise that I would be available consistently.

If a lack of availibility would impact this being implimented I understand, and I appreciate all you've done to get LUKS up and running to begin with! <3

[gitbls]

Update: Network Bound Disk Encryption (NBDE, the formal name for tang/clevis) will be in the next release to unlock an encrypted rootfs. Fallback to passphrase or keyfile (whichever is configured) also works, which is handy if the tang server is offline.

NBDE unlock for non-rootfs data partitions is deferred for now. I have it working if the tang server is up, but wiring up the passphrase or keyfile fallback turned out to be a lot more challenging. A very reasonable and secure alternative is to use NBDE to unlock the rootfs, and a keyfile in /root to unlock the data partition.

I am targeting to have this completed later this week.

Lastly, thanks for the suggestion. This is very cool!

[Handrail9]

Thank you for taking the time to implement it!! I was not expecting to see it implemented so soon so this is very exciting. Is it ready for testing / deployment? Is there anything I should look out for if it is ready for testing? I should have some free time this week to give it a go on my RPi5 so let me know :)

[Handrail9]

I fat fingered the close button with my laptop touchpad on accident, I did not mean to close the issue.

[gitbls]

I'll have a look into making something available ahead of the release and will let you know once I've made more progress on finishing it up, adding spit polish, etc

[gitbls]

I concluded that the changes were isolated and safe, so have released V15.4 that contains the NBDE support. Suggest you read the updated Doc https://github.com/gitbls/sdm/blob/master/Docs/Disk-Encryption.md

Please let me know how it goes. Thanks!