Restore access to data with escrow packet

1. Boot the system in an environment where volum e_key can be run and the escrow packet is available (a rescue mode, for example).

2. Run:

volume_key --restore /path/to/volume escrow-packet

A prompt will appear for the escrow packet passphrase that was used when creating the escrow packet, and for the new passphrase for the volume.

3. Mount the volume using the chosen passphrase.

To free up the passphrase slot in the LUKS header of the encrypted volume, remove the old, forgotten passphrase by using the command cryptsetup luksKillSlot.

19.3. Using volume_key in a larger organization

In a larger organization, using a single password known by every system administrator and keeping track of a separate password for each system is impractical and a security risk. To counter this, volum e_key can use asymmetric cryptography to minimize the number of people who know the password required to access encrypted data on any computer.

This section will cover the procedures required for preparation before saving encryption keys, how to save encryption keys, restoring access to a volume, and setting up emergency passphrases.

19.3.1. Preparation for saving encryption keys

In order to begin saving encryption keys, some preparation is required.

Procedure 19.3. Preparation

1. Create an X509 certificate/private pair.

2. Designate trusted users who are trusted not to compromise the private key. These users will be able to decrypt the escrow packets.

3. Choose which systems will be used to decrypt the escrow packets. On these systems, set up an NSS database that contains the private key.

If the private key was not created in an NSS database, follow these steps:

A. Store the certificate and private key in an PKCS#12 file.

B. Run:

certutil -d /the/nss/directory -N

At this point it is possible to choose an NSS database password. Each NSS database can have a different password so the designated users do not need to share a single password if

Chapter 19. The volume_key function

a separate NSS database is used by each user.

C. Run:

pk12util -d /the/nss/directory -i the-pkcs12-file

4. Distribute the certificate to anyone installing systems or saving keys on existing systems.

5. For saved private keys, prepare storage that allows them to be looked up by machine and volume.

For example, this can be a simple directory with one subdirectory per machine, or a database used for other system management tasks as well.

19.3.2. Saving encryption keys

After completing the required preparation (see Section 19.3.1, “Preparation for saving encryption keys”) it is now possible to save the encryption keys using the following procedure.

Note

For all examples in this file, /path/to/volum e is a LUKS device, not the plaintext device contained within; blkid -s type /path/to/volume should report type="crypto_LUKS".

Procedure 19.4 . Saving encryption keys

1. Run:

volume_key --save /path/to/volume -c /path/to/cert escrow-packet

2. Save the generated escrow-packet file in the prepared storage, associating it with the system and the volume.

These steps can be performed manually, or scripted as part of system installation.

19.3.3. Restoring access to a volume

After the encryption keys have been saved (see Section 19.3.1, “Preparation for saving encryption keys”

and Section 19.3.2, “Saving encryption keys”), access can be restored to a driver where needed.

Procedure 19.5. Restoring access to a volume

1. Get the escrow packet for the volume from the packet storage and send it to one of the designated users for decryption.

2. The designated user runs:

volume_key --reencrypt -d /the/nss/directory packet-in -o escrow-packet-out

After providing the NSS database password, the designated user chooses a passphrase for encrypting escrow-packet-out. This passphrase can be different every time and only protects the encryption keys while they are moved from the designated user to the target system.

3. Obtain the escrow-packet-out file and the passphrase from the designated user.

4. Boot the target system in an environment that can run volum e_key and have the escrow-packet-out file available, such as in a rescue mode.

5. Run:

volume_key --restore /path/to/volume escrow-packet-out

A prompt will appear for the packet passphrase chosen by the designated user, and for a new passphrase for the volume.

6. Mount the volume using the chosen volume passphrase.

It is possible to remove the old passphrase that was forgotten by using cryptsetup luksKillSlot, for example, to free up the passphrase slot in the LUKS header of the encrypted volume. This is done with the command cryptsetup luksKillSlot device key-slot. For more information and examples see cryptsetup --help.

19.3.4. Setting up emergency passphrases

In some circumstances (such as traveling for business) it is impractical for system administrators to work directly with the affected systems, but users still need access to their data. In this case, volum e_key can work with passphrases as well as encryption keys.

During the system installation, run:

volume_key --save /path/to/volume -c /path/to/ert --create-random-passphrase passphrase-packet

This generates a random passphrase, adds it to the specified volume, and stores it to passphrase-packet. It is also possible to combine the --create-random -passphrase and -o options to generate both packets at the same time.

If a user forgets the password, the designated user runs:

volume_key --secrets -d /your/nss/directory passphrase-packet This shows the random passphrase. Give this passphrase to the end user.

19.4. Documentation

More information on volum e_key can be found:

in the readme file located at /usr/share/doc/volum e_key-* /README on volum e_key's manpage using m an volum e_key

online at http://fedoraproject.org/wiki/Disk_encryption_key_escrow_use_cases

Chapter 19. The volume_key function