From: Clemens Fruhwirth <clemens@endorphin.org>
To: Milan Broz <gmazyland@gmail.com>
Cc: Volker Dormeyer <vd@d7informatics.de>, dm-crypt@saout.de
Subject: [dm-crypt] Re: Reading the passphrase from a key-file
Date: Fri, 14 May 2021 17:22:39 +0200 [thread overview]
Message-ID: <CAG6gW_sZNhYdsuooOaBmYvkH=J+=CiNMzu_3JGBH71bXcPcErA@mail.gmail.com> (raw)
In-Reply-To: <286a7fed-2e24-b622-d9fd-ed3445a547be@gmail.com>
On Fri, 14 May 2021 at 15:44, Milan Broz <gmazyland@gmail.com> wrote:
>
> On 14/05/2021 13:51, Volker Dormeyer wrote:
> > Hello,
> >
> > today I have another question regading the key-file option. I am
> > scripting something where the passphare is given by STDIN, with the
> > following options:
> >
> > cryptsetup luksOpen /dev/sde hdd --header header.img --key-file -
> >
> > If I enter this line on a command line it prompts me with "Enter
> > passphrase for /dev/sde", I was suspecting nothing. How can I make sure
> > that the passphrase is being read form STDIN?
>
> Cryptsetup checks if there is input from a real terminal (then displays this message)
> or from a pipe. echo pwd | cryptsetup ... works.
>
> But if the input is a binary file, it will stop on the first EOL (then you must use --keyfile-size).
> Please read "NOTES ON PASSPHRASE PROCESSING FOR LUKS" in the man page.
Milan, could you help my memory here:
> From key file: The complete keyfile is read up to the compiled-in maximum size. Newline characters do not terminate the input. The --keyfile-size
> option can be used to limit what is read.
Did I chose this "up to the compiled-in maximum size" either
explicitly or implicitly back in the days? Checking get_key inside
lib/utils.c in the ancient release 1.0.6 from some time in 2007 looks
as if there was no such limit.
Introducing a compile-time limit has the unfortunate property that two
cryptsetup binaries compiled with different settings won't be able to
produce compatible key slots when pointed to key files that exceed
this compiled-in limit.
Cheers,
--
Fruhwirth Clemens http://clemens.endorphin.org
_______________________________________________
dm-crypt mailing list -- dm-crypt@saout.de
To unsubscribe send an email to dm-crypt-leave@saout.de
next prev parent reply other threads:[~2021-05-14 15:25 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-05-14 11:51 [dm-crypt] Reading the passphrase from a key-file Volker Dormeyer
2021-05-14 13:41 ` [dm-crypt] " Milan Broz
2021-05-14 13:53 ` Arno Wagner
2021-05-14 14:12 ` Christoph Anton Mitterer
2021-05-14 15:22 ` Clemens Fruhwirth [this message]
2021-05-14 15:50 ` Milan Broz
2021-05-14 18:10 ` Clemens Fruhwirth
2021-05-14 20:43 ` Milan Broz
2021-05-15 7:08 ` Clemens Fruhwirth
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAG6gW_sZNhYdsuooOaBmYvkH=J+=CiNMzu_3JGBH71bXcPcErA@mail.gmail.com' \
--to=clemens@endorphin.org \
--cc=dm-crypt@saout.de \
--cc=gmazyland@gmail.com \
--cc=vd@d7informatics.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).