nixpkgs/nixos/modules
Moritz Maxeiner 407a770161 Rewrite as a pre-boot authentication module (mostly) comforming to the design specification of
'YubiKey Integration for Full Disk Encryption Pre-Boot Authentication (Copyright) Yubico, 2011 Version: 1.1'.

Used binaries:
  * uuidgen - for generation of random sequence numbers
  * ykchalresp - for challenging a Yubikey
  * ykinfo - to check if a Yubikey is plugged in at boot (fallback to passphrase authentication otherwise)
  * openssl - for calculation of SHA-1, HMAC-SHA-1, as well as AES-256-CTR (de/en)cryption

Main differences to the specification mentioned above:
  * No user management (yet), only one password+yubikey per LUKS device
  * SHA-512 instead of CRC-16 for checksum

Main differences to the previous implementation:
  * Instead of changing the key slot of the LUKS device each boot,
    the actual key for the LUKS device will be encrypted itself
  * Since the response for the new challenge is now calculated
    locally with openssl, the MITM-USB-attack with which previously
    an attacker could obtain the new response (that was used as the new
    encryption key for the LUKS device) by listening to the
    Yubikey has ideally become useless (as long as uuidgen can
    successfuly generate new random sequence numbers).

Remarks:
  * This is not downwards compatible to the previous implementation
2014-01-28 04:02:51 +01:00
..
config Don't set $TZ 2014-01-06 18:27:07 +01:00
hardware Add some primops to lib 2013-11-12 13:48:30 +01:00
installer Put /efi and /loader on the main livecd partition for efi booting with unetbootin 2013-11-14 18:18:46 -05:00
misc nixos/cgminer: fix restarts, set uid 2014-01-13 00:19:06 +01:00
profiles Hack to work around the lack of isPath 2013-10-28 22:45:57 +01:00
programs nixos: capitalize a bunch of service descriptions 2013-11-09 20:45:50 +01:00
security polkit: Add some examples 2013-11-18 18:04:17 +01:00
services networkmanager: load modules required for PPTP 2014-01-24 09:22:59 -06:00
system Rewrite as a pre-boot authentication module (mostly) comforming to the design specification of 2014-01-28 04:02:51 +01:00
tasks network-interfaces: Add the ability to create bond devices 2013-12-31 09:28:52 -06:00
testing Rename linuxManualConfig to buildLinux 2014-01-21 20:05:55 -05:00
virtualisation Google Compute image: fix punctuation in description, give disk image proper name with version and revision. 2013-12-12 12:48:09 +01:00
module-list.nix Adds a service for haveged, the entropy daemon 2014-01-17 22:10:52 +11:00
rename.nix nixos: Split mesa setup from xserver.nix 2014-01-15 08:17:19 -05:00