Šifriranje trdega diska

Compatible Nitrokeys

3A/C/Mini

Passkey

HSM 2

Pro 2

FIDO2

Storage 2

Start

U2F

✓

active

⨯

inactive

✓

active

✓

active

⨯

inactive

✓

active

✓

active

⨯

inactive

VeraCrypt (prej TrueCrypt)

VeraCrypt je brezplačna odprtokodna programska oprema za šifriranje diskov za operacijske sisteme Windows, macOS in GNU+Linux. Je naslednik programa TrueCrypt in je zato priporočljiv, čeprav morajo naslednja navodila veljati tudi za TrueCrypt.

Follow these steps to use the program with Nitrokey Storage 2 or Nitrokey Pro 2:

  1. Namestite najnovejšo izdajo OpenSC ali prenesite Knjižnico PKCS#11.

  2. Choose the library in VeraCrypt under Settings>Preferences>Security Token (location depends on system, e.g. /usr/lib/opensc).

  3. Ustvarite 64 bajtno datoteko s ključem prek orodja Tools>Keyfile Generator.

  4. Now you should be able to import the generated key file via Tools>Manage Security Token Keyfiles. You should choose the first Slot ([0] User PIN). The keyfile is then stored on the Nitrokey as Private Data Object 1 (PrivDO1).

  5. Po tem morate varno izbrisati izvirno datoteko s ključi v računalniku!

  6. Zdaj lahko VeraCrypt uporabljate s ključem Nitrokey: ustvarite vsebnik in kot alternativo geslu izberite datoteko s ključem v napravi.

Opozorilo

Varnostni vidik

Please note that VeraCrypt doesn’t make use of the full security which Nitrokey (and smart cards in general) offer. Instead it stores a keyfile on the Nitrokey which theoretically could be stolen by a compromised host, since the Private Data Object 1 is not protected by the Nitrokey’s PIN.

Šifriranje trdega diska v sistemu GNU+Linux z LUKS/dm-crypt

Za nastavitev šifriranja diskov LUKS sledite našemu vodniku:

Purism has created a simple script to add the Nitrokey/LibremKey as a way to unlock LUKS partitions (not tested by Nitrokey yet).

Ta projekt je namenjen olajšanju uporabe sistema LUKS s programom Nitrokey Pro ali shrambo, ki temelji na programu Password Safe (Nitrokey ga še ni preizkusil). Opis uporabe v sistemu Gentoo najdete tudi.

Za Arch Linux glejte initramfs-scencrypt.

Šifriranje shrambe v operacijskem sistemu GNU+Linux s sistemom EncFS

Nasvet

Predpogoj

Prepričajte se, da ste nastavili gonilnik naprave, spremenili privzete kode PIN in ustvarili ali uvozili ključe z GnuPG.

EncFS is an easy to utlity for encrypted file systems and it is based on FUSE. You may follow these steps to use it with very long passwords and Nitrokey Pro 2.

Inicializacija

  1. Ustvarite datoteko s ključi z naključnimi podatki:

    $ dd bs=64 count=1 if=/dev/urandom of=keyfile

  2. Šifrirajte datoteko s ključem in uporabite uporabniško ime svojega ključa Nitrokey

    $ gpg --encrypt keyfile

  3. Odstranite datoteko s ključi v čistem besedilu:

    $ rm keyfile # you may want to use 'wipe' or 'shred' to securely delete the keyfile

  4. Ustvari priklopno točko:

    $ mkdir ~/.cryptdir ~/cryptdir

  5. Ustvarite dejansko mapo za šifriranje

    $ gpg -d keyfile.gpg | encfs -S ~/.cryptdir ~/cryptdir
# There may appears an error message about missing permission of fusermount
# This message can be ignored

  6. Odmontirajte novi datotečni sistem:

    $ fusermount -u ~/cryptdir

Uporaba

  1. Namestite šifrirani datotečni sistem in vnesite kodo PIN Nitrokey:

    $ gpg -d keyfile.gpg | encfs -S ~/.cryptdir ~/cryptdir

  2. Po uporabi odmontirajte datotečni sistem:

    $ fusermount -u ~/cryptdir

Šifriranje shrambe v operacijskem sistemu GNU+Linux s sistemom ECryptFS

eCryptfs je datotečni sistem za pregledno šifriranje za GNU+Linux, ki ga je mogoče uporabljati z Nitrokeyjem prek gonilnika PKCS#11.

Oglejte si to navodila:

  1. Uvoz certifikata in ključa v Nitrokey

    # Warning: This will delete existing keys on your Nitrokey!
$ pkcs15-init --delete-objects privkey,pubkey --id 3 --store-private-key user@example.com.p12 --format pkcs12 --auth-id 3 --verify-pin

  2. Ustvarite datoteko ~/.ecryptfsrc.pkcs11:

    $ editor ~/.ecryptfsrc.pkcs11

  3. Vnesite to vsebino:

    $ pkcs11-log-level=5 pkcs11-provider1,name=name,library=/usr/lib/opensc-pkcs11.so,cert-private=true
$ openvpn --show-pkcs11-ids path to opensc-pkcs11 module
Certificate
    DN: /description=Iv4IQpLO02Mnix9i/CN=user@example.com/emailAddress=user@example.com
    Serial: 066E04
    Serialized id: ZeitControl/PKCS\x2315\x20emulated/000500000c7f/OpenPGP\x20card\x20\x28User\x20PIN\x29/03

  4. Kopirajte serializirani id za poznejšo uporabo:

    $ ecryptfs-manager
# This will show list option. Choose option "Add public key to keyring"
# Choose pkcs11-helper
# Enter the serialized ID of step 3 to PKCS#11 ID.

Poskusite tudi ESOSI ali sledite tem korakom z uporabo OpenSC in OpenVPN.

Vir vodnika: https://www.nitrokey.com/documentation/applications#a:hard-disk-encryption