https://lug.mtu.edu/w/index.php?action=history&feed=atom&title=Minutes_2025-10-30 Minutes 2025-10-30 - Revision history 2026-04-29T17:47:55Z Revision history for this page on the wiki MediaWiki 1.39.17 https://lug.mtu.edu/w/index.php?title=Minutes_2025-10-30&diff=8005&oldid=prev D2wn at 03:33, 31 October 2025 2025-10-31T03:33:32Z <p></p> <table style="background-color: #fff; color: #202122;" data-mw="interface"> <col class="diff-marker" /> <col class="diff-content" /> <col class="diff-marker" /> <col class="diff-content" /> <tr class="diff-title" lang="en"> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 03:33, 31 October 2025</td> </tr><tr> <td colspan="2" class="diff-lineno">Line 3:</td> <td colspan="2" class="diff-lineno">Line 3:</td> </tr> <tr> <td class="diff-marker"></td> <td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>### Refresher: Disk Encryption</div></td> <td class="diff-marker"></td> <td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>### Refresher: Disk Encryption</div></td> </tr> <tr> <td class="diff-marker"></td> <td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>### On Linux usually use Linux Unified Key System (LUKS)</div></td> <td class="diff-marker"></td> <td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>### On Linux usually use Linux Unified Key System (LUKS)</div></td> </tr> <tr> <td class="diff-marker" data-marker="−"></td> <td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>#### See: Noah's LUKS presentation (<del style="font-weight: bold; text-decoration: none;">LINK</del> <del style="font-weight: bold; text-decoration: none;">HERE</del>)</div></td> <td class="diff-marker" data-marker="+"></td> <td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>#### See: Noah's LUKS presentation (<ins style="font-weight: bold; text-decoration: none;">[[Minutes</ins> <ins style="font-weight: bold; text-decoration: none;">2025-10-02]]</ins>)</div></td> </tr> <tr> <td class="diff-marker"></td> <td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>### Why?</div></td> <td class="diff-marker"></td> <td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>### Why?</div></td> </tr> <tr> <td class="diff-marker"></td> <td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>### Protects data against unauthorized access</div></td> <td class="diff-marker"></td> <td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>### Protects data against unauthorized access</div></td> </tr> </table> D2wn https://lug.mtu.edu/w/index.php?title=Minutes_2025-10-30&diff=8004&oldid=prev D2wn: added Meeting Minutes category tag 2025-10-31T03:32:56Z <p>added Meeting Minutes category tag</p> <table style="background-color: #fff; color: #202122;" data-mw="interface"> <col class="diff-marker" /> <col class="diff-content" /> <col class="diff-marker" /> <col class="diff-content" /> <tr class="diff-title" lang="en"> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 03:32, 31 October 2025</td> </tr><tr> <td colspan="2" class="diff-lineno">Line 100:</td> <td colspan="2" class="diff-lineno">Line 100:</td> </tr> <tr> <td class="diff-marker"></td> <td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>### Allows for unattended unlocking, improves practicality of FDE systems</div></td> <td class="diff-marker"></td> <td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>### Allows for unattended unlocking, improves practicality of FDE systems</div></td> </tr> <tr> <td class="diff-marker"></td> <td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>### Tang/Clevis and Mandos</div></td> <td class="diff-marker"></td> <td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>### Tang/Clevis and Mandos</div></td> </tr> <tr> <td colspan="2" class="diff-empty diff-side-deleted"></td> <td class="diff-marker" data-marker="+"></td> <td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>[[Category:Meeting Minutes]]</div></td> </tr> </table> D2wn https://lug.mtu.edu/w/index.php?title=Minutes_2025-10-30&diff=8003&oldid=prev D2wn: initial commit 2025-10-31T03:32:37Z <p>initial commit</p> <p><b>New page</b></p><div># Network Bound Disk Encryption by Simone!<br /> ## Background<br /> ### Refresher: Disk Encryption<br /> ### On Linux usually use Linux Unified Key System (LUKS)<br /> #### See: Noah&#039;s LUKS presentation (LINK HERE)<br /> ### Why?<br /> ### Protects data against unauthorized access<br /> #### AKA Theft/Loss<br /> ### Nice when decommissioning hardware<br /> #### Peace of mind that the data is inaccessible<br /> ### However, typically requires a password to unlock<br /> #### Does not work when rebooting remote servers<br /> ## What about TPM?<br /> ### Can allow for automatic unlocking of disk<br /> ### But... security issues<br /> #### Key sniffing attacks<br /> #### Backdoor concerns<br /> ##### TPMs made by third-party manufacturers<br /> #### fTPM<br /> ##### Potentially vulnerable to firmware attacks<br /> ### Not always available on all hardware platforms<br /> ## This leads into Network Bound Disk Encryption<br /> ### Don&#039;t have to manually enter password<br /> ### Typically involves a keyserver<br /> ### Allow decryption under some circumstances<br /> #### On a trusted network, during a time interval, etc<br /> ### Clevis/Tang<br /> #### Pushed by RedHat, but Distro agnostic<br /> #### Clevis = Key retrieval for LUKS volumes<br /> #### Tang = Stateless HTTP endpoint for Clevis<br /> #### Because stateless, prevents sniffing/replay attacks on a network<br /> #### Supports root and secondary devices<br /> ### Mandos<br /> #### Older, less well-known<br /> #### Specific to Ubuntu(/Debian)<br /> #### Stateful, stores secret on the server<br /> #### Uses TLS<br /> #### Time-based, checks if a client goes offline<br /> #### Root filesystem only<br /> #### Refuses to send decryption key if device has been offline for too long<br /> ##### Protect against tampering/lost devices being turned on again<br /> ## How it works<br /> ### Key exchange to get decryption key<br /> ### LUKS volume can still be decrypted with a password, if manual maintenance is ever required or the keyserver breaks<br /> ## Live Demo!<br /> ### Two VMs<br /> #### Client and Server<br /> ### Can reboot client<br /> #### Boots into initramfs<br /> ##### Gets IP via DHCP<br /> ##### Connects to Tang server<br /> ##### Received needed secrets, continues boot process<br /> ### Wireshark capture of client booting<br /> #### Data is transmitted via JSON over HTTP<br /> #### Data is ephemeral, not useful beyond this current initial session<br /> ### Multiple keyslots to decrypt the LUKS volume<br /> #### Keyslot 0 = Decrypted with a password (for manual decryption)<br /> #### Keyslot 1 = Used by Clevis for the network-bound decrypt<br /> ## Common implementations<br /> ### Headless servers<br /> ### Remote offices<br /> ### Devices spread across wide geographical regions<br /> ### Cloud/VM environments<br /> #### Allow each guest to have its own encryption rather than managed at the hypervisor-level<br /> ## Security<br /> ### Clevis/Tang<br /> #### Designed for a trusted network<br /> #### McCallum-Relyea key exchange means data is meaningless to an attacker<br /> ## NBDE over the internet is possible<br /> ### Clevis can use HTTPS<br /> ### Mandos uses TLS<br /> ### However, more common to just run it through a site-to-site VPN<br /> #### Also reduces your infrastructure&#039;s attack service<br /> ##### Only the VPN port is exposed to the internet rather than Clevis<br /> ## Limitations<br /> ### Requires Server and client have network connection and be available at the same time<br /> #### Server outage means clients can&#039;t get their decryption keys<br /> #### Can run redundant Tang/Mandos servers ti be keyservers for each other<br /> ### Linux-only<br /> #### Windows apparently has a similar feature in Windows AD with Bitlocker<br /> #### Obscure and extremely limited<br /> ### No user authentication<br /> ### Live attacks<br /> ### Freezing DIMMs to read memory contents and extract key content<br /> #### Mitigated by encrypting RAM contents<br /> ### Consider your threat model/attacker<br /> #### Works against the common thief/burglar<br /> #### Maybe not against a nation state adversary, but you&#039;ll have bigger problems to worry about<br /> ## Future extensions<br /> ### MFA authentication<br /> #### Tang+TPM for dual control<br /> #### Security keys/smartcards<br /> ### More user-friendly UX/interfaces<br /> ### Direct VPN integration<br /> #### Wireguard tunnel inside initramfs for encryption-across-internet use-cases<br /> ### Support beyond just LUKS<br /> #### ZFS/Bitlocker/FileVault?<br /> #### Realistically integration extremely unlikely, especially knowing Apple (in this case, for FileVault)<br /> ## Summary<br /> ### Allows for unattended unlocking, improves practicality of FDE systems<br /> ### Tang/Clevis and Mandos</div> D2wn