Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

WiP: Generate diceware passphrases in oem-factory-reset, output qr code of configured secrets prior of reboot #1850

Open
wants to merge 9 commits into
base: master
Choose a base branch
from

Commits on Nov 21, 2024

  1. diceware: add short list v2, requiring 4 dices and providing longer w…

    …ords then short list v1 for easier to remember passphrases
    
    This lists comes from https://www.eff.org/files/2016/09/08/eff_short_wordlist_2_0.txt
    Refered in article: https://www.eff.org/dice
    
    Signed-off-by: Thierry Laurion <[email protected]>
    tlaurion committed Nov 21, 2024
    Configuration menu
    Copy the full SHA
    b00ae01 View commit details
    Browse the repository at this point in the history
  2. initrd/etc/functions: add generate_passphrase logic

    Nothing uses it for the moment, needs to be called from recovery shell: bash, source /etc/functions. generate_passphrase
    
    - parses dictionary to check how many dice rolls needed on first entry, defaults to EFF short list v2 (bigger words easier to remember, 4 dices roll instead of 5)
      - defaults to using initrd/etc/diceware_dictionnaries/eff_short_wordlist_2_0.txt, parametrable
      - make sure format of dictionary is 'digit word' and fail early otherwise: we expect EFF diceware format dictionaries
    - enforces max length of 256 chars, parametrable, reduces number of words to fit if not override
    - enforces default 3 words passphrase, parametrable
    - enforces captialization of first letter, lowercase parametrable
    - read multiple bytes from /dev/urandom to fit number of dice rolls
    
    Unrelated: uniformize format of file
    
    Signed-off-by: Thierry Laurion <[email protected]>
    tlaurion committed Nov 21, 2024
    Configuration menu
    Copy the full SHA
    9ecbc0a View commit details
    Browse the repository at this point in the history
  3. WiP initrd/bin/oem-factory-reset: format unification

    Signed-off-by: Thierry Laurion <[email protected]>
    tlaurion committed Nov 21, 2024
    Configuration menu
    Copy the full SHA
    5133f10 View commit details
    Browse the repository at this point in the history
  4. WiP initrd/bin/oem-factory-reset: add --mode (oem/user) skeleton

    Signed-off-by: Thierry Laurion <[email protected]>
    tlaurion committed Nov 21, 2024
    Configuration menu
    Copy the full SHA
    794acce View commit details
    Browse the repository at this point in the history
  5. /etc/functions:: reuse detect_boot_device instead of trying only to m…

    …ount /etc/fstab existing /boot partition (otherwise early 'o' to enter oem mode of oem-factory-reset
    
    Signed-off-by: Thierry Laurion <[email protected]>
    tlaurion committed Nov 21, 2024
    Configuration menu
    Copy the full SHA
    cd5d31c View commit details
    Browse the repository at this point in the history
  6. WiP initrd/bin/oem-factory-reset: add qrcode+secet output loop until …

    …user press y (end of reownership wizard secret output)
    
    Signed-off-by: Thierry Laurion <[email protected]>
    
    works:
    - oem and user mode passphrase generation
    - qrcode
    
    missing:
    - unattended
      - luks reencryption + passphrase change for OEM mode (only input to be provided) with SINGLE passphrase when in unattended mode
        - same for user reownership when previously OEM reset unattended
    
    Signed-off-by: Thierry Laurion <[email protected]>
    tlaurion committed Nov 21, 2024
    Configuration menu
    Copy the full SHA
    b681574 View commit details
    Browse the repository at this point in the history

Commits on Nov 28, 2024

  1. Configuration menu
    Copy the full SHA
    dcc0dc4 View commit details
    Browse the repository at this point in the history
  2. Configuration menu
    Copy the full SHA
    7db2790 View commit details
    Browse the repository at this point in the history
  3. WiP: add nk3 secret app reset function and call it following security…

    … dongle reset logic
    
    Signed-off-by: Thierry Laurion <[email protected]>
    tlaurion committed Nov 28, 2024
    Configuration menu
    Copy the full SHA
    07f3710 View commit details
    Browse the repository at this point in the history