anatol/clevis.go

Pure Golang implementation of clevis encryption framework

clevis.go's Issues

Guide for using YubiKey in initramfs

I have noticed that the package clevis-extra-pins-git on Arch Linux includes the YubiKey functionality from this repo, which can be used to unlock a disk during boot.

It would be nice to have a little guide for how to achieve this (support for YubiKey in Clevis to decrypt a disk during boot) on distros where this package is not available. The guide could be in the readme or in the wiki, I imagine.

Edit: Many systems use Dracut, instead of Booster, for creating an initramfs, so that's what I had in mind.

Implement fingerprint encryption/decryption

It is a counterpart for the upstream issue latchset/clevis#245

Some computers (e.g. Lenovo Thinkpad X1 Yoga) have a built in fingerprint sensor. This would be a good candidate for a clevis pin. Having a clevis-fingerprint pin will allow to have a full-disk-encryption with fingerprint unlock functionality. That is a convenient and secure way to protect the user data.

I haven't really looked at fingerprint API but I found a few projects that actively use this functionality. It is something that can give pointers on utilizing fingerprint sensor in celvis.

https://gitlab.freedesktop.org/libfprint/fprintd/-/blob/master/pam/pam_fprintd.c
https://gitlab.freedesktop.org/libfprint/fprintd/-/tree/master
https://gitlab.freedesktop.org/libfprint/libfprint

Implement Encrypt() logic

Currently clevis.go focuses on decryption logic only. But it would be great to add Encrypt() for completeness as well.

Add structs for clevis pins

Rather than just using raw map[string] interface{} when dealing with these clevis pin configurations, it would be convenient to provide a struct with full json marshalling/unmarshalling.

Implement binary store format for encrypted clevis data

Currently clevis uses json to store its encrypted data. It also uses base64 encoding a lot. So clevis has a lot of binary->base64->json->base64->... conversions. It adds quite a lot of space and CPU overhead and this could be a problem for services that store/handle a lot of encrypted data.

Try to implement a binary encoding for clevis data using Thrift protocol.

GitHub complains about workflow errors

Every time I create or update a PR, the workflow fails to run.

Example: https://github.com/anatol/clevis.go/actions/runs/1021199605

Implement yubikey encryption/decryption

This is a counterpart for the upstream issue latchset/clevis#46

Having clevis support for Yubikey would be useful for consumer workstation. It would allow to implement a full-disk-encryption protected by a hardware key.

Implement cryptsetup plugin for clevis tokens

cryptsetup 2.4.0 added a plugin feature for token parsing [1]. It allows handling tokens internalling using a shared library API.

Implement a shared library for cryptsetup based on clevis.go code.

https://mirrors.edge.kernel.org/pub/linux/utils/cryptsetup/v2.4/v2.4.0-ReleaseNotes