[dm-crypt] PKCS#11 support in cryptsetup
johanna-a at mjao.org
Sat May 7 09:03:15 CEST 2016
I am aware that this has been previously discussed in the following threads:
I have been working on bringing PKCS#11 support to systemd's
"cryptsetup" (that uses libcryptsetup). However, maintainers of
systemd has suggested that cryptsetup may be a better place for this
The relevant discussions on systemd are:
In a comment to the last pull request I suggest adding pkcs#11 support
in cryptsetup in a similar way as to how keyfiles are handled. In a
way keyfiles and pkcs#11 data objects are quite similar. Both are
accessiable via an URI (https://tools.ietf.org/html/rfc7512), both can
be read depending on size or until EOF.
The main problem is that pkcs#11 are accessed through a provider,
rather than a filesystem. Providers are not included in the kernel and
as such are less "accessible". I have tried to find a standard way of
enumerating providers in UNIX systems but unfortunately there seems to
be none. The closest seem to be p11-kit
I would suggest that the solution to this would be to accept a
provider through arguments.
What are your thoughts on this?
More information about the dm-crypt