On Mon, Oct 17, 2011 at 05:47:31PM +0200, Milan Broz wrote: > On 10/17/2011 04:39 PM, .. ink .. wrote: > > Why doesnt cryptsetup support two factor authentication? > > I like the Unix approach - one simple program, one function. The thing is that you cannot do 2-factor authentication generically. You typically have password/passphrase as one factor, and that can be done generically and is implemented in cryptsetup. However the second factor is usually a token or biometrics and there is no way to do these generically. They always have to be customized to the concrete solution. While there are generic smarcard indterfaces, they are still problematic for this use. I think the present approach is prefectly fine. It is also easy to script in a concrete token or biometrics, just use a longer passphrase and split it, as originally suggested. Or use the library, although that does not provide a conceptyal security increase as compared to scripting. > cryptsetup is nothing more than low-level configuration > for dmcrypt and on-disk metadata (key management) wrapper. > And provides library covering that. > > You can build various plugins (see e.g. how pam_mount > or systemd uses libcryptsetup) but I would like to cryptsetup > remains simple utility just for this exact task. > > (But maybe we should add various wrappers to code tree later.) I can see that happening, e.g. as soon as there is a stable token standard with working multi-vendor support. Or if, for example, there is a widely-adopted standard for a smartphone to prove its presence (misusing a phone as a token). Arno -- Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno@xxxxxxxxxxx GnuPG: ID: 1E25338F FP: 0C30 5782 9D93 F785 E79C 0296 797F 6B50 1E25 338F ---- Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans If it's in the news, don't worry about it. The very definition of "news" is "something that hardly ever happens." -- Bruce Schneier _______________________________________________ dm-crypt mailing list dm-crypt@xxxxxxxx http://www.saout.de/mailman/listinfo/dm-crypt
