From owner-freebsd-geom@FreeBSD.ORG Fri Jun 15 20:41:41 2012 Return-Path: Delivered-To: freebsd-geom@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id D0326106566B for ; Fri, 15 Jun 2012 20:41:41 +0000 (UTC) (envelope-from rsimmons0@gmail.com) Received: from mail-vc0-f182.google.com (mail-vc0-f182.google.com [209.85.220.182]) by mx1.freebsd.org (Postfix) with ESMTP id 85A178FC08 for ; Fri, 15 Jun 2012 20:41:41 +0000 (UTC) Received: by vcbfy7 with SMTP id fy7so2343702vcb.13 for ; Fri, 15 Jun 2012 13:41:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type:content-transfer-encoding; bh=tvpQDlFf1NKtbaLb4hrgkP91j9Y44lSf6jFa0Iz2YQc=; b=QiWZpn1/w90mktKsVgFv9wpLRegtE091gCfj8j61YcR1Dfl5BRmOVd9LkT7+/3Lw1W Q+avrNkFKo5O2UIhGqrIisXo0OSpsKQJ9IDvr3kkTVUBKvBRNBxkBQ33rjjA4tiDrgsQ ydv+szSZ6CY/JXy7ZrpPtGvtY5lOMd1d6qKzeh0dQVmbn/SKZkA/v3/Mrku4ABMYMwyz 471ZkpXfPQoRQ441elAgLvNHcO2pg6CiNbWeyp1+KO1lPe0F4zWpL2/NpUfXVCTtRRE7 fhnqKtb57of4N0oTDWq4zXde/d1Fxv2LhUydUxs4Val/9dbeTlZeCE/BKCDCFfgJHGp3 Uu3Q== MIME-Version: 1.0 Received: by 10.220.108.1 with SMTP id d1mr3719470vcp.19.1339792900689; Fri, 15 Jun 2012 13:41:40 -0700 (PDT) Received: by 10.52.113.97 with HTTP; Fri, 15 Jun 2012 13:41:40 -0700 (PDT) In-Reply-To: <20120615202458.GH1399@garage.freebsd.pl> References: <20120615202458.GH1399@garage.freebsd.pl> Date: Fri, 15 Jun 2012 16:41:40 -0400 Message-ID: From: Robert Simmons To: freebsd-geom@freebsd.org Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Subject: Re: Pre-boot authentication / geli-aware bootcode X-BeenThere: freebsd-geom@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: GEOM-specific discussions and implementations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Jun 2012 20:41:41 -0000 On Fri, Jun 15, 2012 at 4:24 PM, Pawel Jakub Dawidek wrot= e: > On Fri, Jun 15, 2012 at 04:22:18PM -0400, Robert Simmons wrote: >> On Fri, Jun 15, 2012 at 5:31 AM, Alaksiej Carniajeu wro= te: >> > Hi, >> > >> > It's not possible. But, you could have your /boot on a bootable >> > usbstick, together with some keyfiles, and start from it. From >> > security point of view, it is even better, than the whole drive >> > encryption TrueCrypt offers, because the former relies on password >> > only. >> >> This is what I thought. =A0Now, if I wanted to add this functionality, I >> would need to modify: >> /head/sys/boot/i386/pmbr/pmbr.s >> and >> /head/sys/boot/i386/gptboot/gptboot.c > > I'd leave pmbr.s alone, it is definiately too early to play with > decryption. You need to modify gptboot and loader for UFS or gptzfsboot > and zfsloader for ZFS. All of the decryption work is handled by the geom_eli kernel module, correct? I would assume that looking at the code in /head/sys/geom/eli and seeing how it's done there would be a good place to start.