Owen Taylor, creator of GNOME Shell and the Pango library, a member of the Fedora Workstation development group, has proposed a plan for default encryption of system partitions and user home directories in Fedora Workstation. The benefits of switching to default encryption include data protection in case of laptop theft, protection against attacks on unattended devices, and maintenance of privacy and integrity out of the box without the need for additional manipulations.
According to the draft plan prepared for encryption, Btrfs fscrypt is planned to be used. For system partitions, the encryption keys are proposed to be stored in the TPM module and linked to digital signatures used to verify the integrity of the bootloader, kernel, and initrd (i.e., at the system boot stage, the user will not need to enter a password to decrypt the system partitions). When encrypting home directories, keys are planned to be generated based on the user's login and password (the connection to the encrypted home directory will be made at the time the user logs into the system).
The timeline for implementing this initiative depends on the distribution's transition to a unified UKI (Unified Kernel Image), which combines a kernel boot handler from UEFI (UEFI boot stub), the Linux kernel image, and the initrd in memory. Without UKI support, it is impossible to guarantee the integrity of the initrd environment, where keys for decrypting the file system are determined (for example, an attacker can substitute initrd and simulate a password request; to avoid this, a verified boot of the entire chain is required before mounting the file system).
V aktuálnom stave má inštalátor Fedora možnosť šifrovať partition na blokovej úrovni pomocou dm-crypt s použitím samostatnej heslovej frázy, ktorá nie je viazaná na používateľský účet. Toto riešenie sa potýka s problémami, ako je nevhodnosť pre oddelené šifrovanie v multiužívateľských systémoch, absencia podpory internacionalizácie a prostriedkov pre ľudí so zrakovým postihnutím, možnosť vykonania útokov podvodom s bootloaderom (nainštalovaný útočníkom môže predstierať originálny bootloader a požiadať o heslo na dešifrovanie), potreba podpory framebufferu v initrd na zobrazenie požiadavky na heslo.
Zdroj: opennet.ru
