From owner-freebsd-geom@FreeBSD.ORG Fri Jun 15 20:26:56 2012 Return-Path: Delivered-To: freebsd-geom@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 16C441065672 for ; Fri, 15 Jun 2012 20:26:56 +0000 (UTC) (envelope-from pawel@dawidek.net) Received: from mail.dawidek.net (60.wheelsystems.com [83.12.187.60]) by mx1.freebsd.org (Postfix) with ESMTP id BBE168FC08 for ; Fri, 15 Jun 2012 20:26:55 +0000 (UTC) Received: from localhost (89-73-195-149.dynamic.chello.pl [89.73.195.149]) by mail.dawidek.net (Postfix) with ESMTPSA id 6C82FF98; Fri, 15 Jun 2012 22:26:54 +0200 (CEST) Date: Fri, 15 Jun 2012 22:24:58 +0200 From: Pawel Jakub Dawidek To: Robert Simmons Message-ID: <20120615202458.GH1399@garage.freebsd.pl> References: MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="Cgrdyab2wu3Akvjd" Content-Disposition: inline In-Reply-To: X-OS: FreeBSD 10.0-CURRENT amd64 User-Agent: Mutt/1.5.21 (2010-09-15) Cc: freebsd-geom@freebsd.org Subject: Re: Pre-boot authentication / geli-aware bootcode X-BeenThere: freebsd-geom@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: GEOM-specific discussions and implementations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Jun 2012 20:26:56 -0000 --Cgrdyab2wu3Akvjd Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Fri, Jun 15, 2012 at 04:22:18PM -0400, Robert Simmons wrote: > On Fri, Jun 15, 2012 at 5:31 AM, Alaksiej Carniajeu wrot= e: > > Hi, > > > > It's not possible. But, you could have your /boot on a bootable > > usbstick, together with some keyfiles, and start from it. From > > security point of view, it is even better, than the whole drive > > encryption TrueCrypt offers, because the former relies on password > > only. >=20 > This is what I thought. Now, if I wanted to add this functionality, I > would need to modify: > /head/sys/boot/i386/pmbr/pmbr.s > and > /head/sys/boot/i386/gptboot/gptboot.c I'd leave pmbr.s alone, it is definiately too early to play with decryption. You need to modify gptboot and loader for UFS or gptzfsboot and zfsloader for ZFS. --=20 Pawel Jakub Dawidek http://www.wheelsystems.com FreeBSD committer http://www.FreeBSD.org Am I Evil? Yes, I Am! http://tupytaj.pl --Cgrdyab2wu3Akvjd Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.19 (FreeBSD) iEYEARECAAYFAk/bmhoACgkQForvXbEpPzQItQCdFBl4Y/iNxyEe5DwSI6SqkfqH 40MAoMvHlxHlKosMDCYSfHbzdbNkF01k =H+Ne -----END PGP SIGNATURE----- --Cgrdyab2wu3Akvjd--