Progress report 1

• I’m ruling out HMAC-SHA1, because:
  • Plain vanilla HMAC-SHA1 uses a shared secret. I don’t want the PC/server to have a copy of the credential. May also be susceptible to MITM/relay attacks.
  • Rolling-code HMAC-SHA1 only partially solves those problems.
  • Encrypted rolling code HMAC-SHA1 solves those problems, but I haven’t found a reliable source for using it with LUKS.
• If using systemd, pick FIDO2:
  • Avoids flaws of HMAC-SHA1.
  • Native support in systemd, so “future-proof”.
  • Wider support than OpenPGP. More HST vendors to choose from, including cheaper options than NitroKey or Yubikey: useful if each sysadmin (or colleague, or relative) needs an HST.
  • Compatible with QubesOS.
• Otherwise, OpenPGP:
  • Like FIDO2, solves HMAC-SHA1 flaws.
  • However:
    • smartcard-key-luks seems unmaintained on GitHub and on GitLab.
    • LUKS with OpenPGP isn’t well-documented for non-Debian-based distros.
• TBD: Clevis/Tang:
  • Remote/network-based unlocking.