Full disk encryption

From postmarketOS
The printable version is no longer supported and may have rendering errors. Please update your browser bookmarks and please use the default browser print function instead.

Also known as FDE for short.

If your device has a Y in the FDE column of the all devices table, you can enable full disk encryption with the --fde parameter.

Needs to be ported to devices individually following this https://wiki.postmarketos.org/wiki/Osk-sdl#Porting_to_New_Devices

Changing Luks Password

To change your luks password, connect your phone's storage medium to a Linux computer with cryptsetup installed.

Run the following command:

sudo cryptsetup luksChangeKey <target-device> -S 0

I can get the target device by running the lsblk command. For example, if my storage medium's partition table looked like:

sde 8:64 1 14.7G 0 disk

├─sde1 8:65 1 110M 0 part

└─sde2 8:66 1 14.6G 0 part

To change my password, I would run:

sudo cryptsetup luksChangeKey /dev/sde2 -S 0

Mounting Additional Encrypted Drives At Boot

As per the following from Alpine and pmOS: https://wiki.alpinelinux.org/wiki/LVM_on_LUKS#Mounting_additional_encrypted_filesystems_at_boot and https://wiki.postmarketos.org/wiki/Fstab

This process will need a Key File that has the password to the encrypted drive.

Generating and/or saving the Key File to be accessible for dmcrypt

Known password to the LUKS drive, below it is listed in /etc/ but the saving directory can be anywhere but needs to be only accessible to root, same with the storing folder for the key:

# mkdir /etc/luks-keys
# chmod +s /etc/luks-keys
# echo "<luks-password>" > /etc/luks-keys/<keyfile-name>
# chmod 600 /etc/luks-keys/<keyfile-name>

Randomly generated password (from Alpine):

# dd bs=512 count=4 if=/dev/urandom of=/root/crypt-home-keyfile.bin
# cryptsetup luksAddKey /dev/sdb1 /root/crypt-home-keyfile.bin

Mounting the encrypted drive

Alpine and pmOS, like Gentoo, uses the dmcrypt service rather than /etc/crypttab.

Install and enable the following:

# apk add cryptsetup cryptsetup-openrc
# rc-update add dmcrypt boot

Add the following lines to /etc/conf.d/dmcrypt:

target=<mounting-name>

source='/dev/<target-device>'

key='<location and name of saved key file from section above, eg /etc/luks-keys/<keyfile-name>>'

Now fstab needs to be enabled and the drive added to the list:

# rc-update add localmount default

Edit /etc/fstab with the information from dmcrypt:

/dev/mapper/<mounting-name> /<mounting-location, eg /home/> auto nosuid,nodev,nofail,x-gvfs-show 0 2

Reboot!

Troubleshooting

Blank screen

Touchscreen works but you can't see what you are typing. Use a keyboard and an OTG cable to enter the password and unlock it. You can also see the phone is still alive by switching with Ctrl + Alt + F1 ~ F6. FDE prompt is usually on second console(F2).

Install msm-fb-refresher to solve the issue:

# apk add msm-fb-refresher
# mkinitfs