4

I'm trying to learn a bit about the linux kernel keyring (as background for using ecryptfs). Does the kernel keyring store keys somewhere on disk, or does it get reinitiailized programmatically everytime the sytem is booted?

I've looked at the man pages and archlinux documentation on encryption but haven't found the answer. If there's other documentation on the kernel keyring, I'd like to know.

If the kernel keyring does store keys on the disk, where does it put the files?

  • 1
    Did you ever find out the answer? – Pod Dec 15 '16 at 16:54
  • Yes, see Gilles answer below – zed4 Dec 16 '16 at 19:38
6

The Linux kernel never stores anything on a disk of its own behalf. It stores the files that applications tell it to store through the filesystem interface, or data on block devices accessed directly, or metadata of mounted filesystems and disk volumes.

Besides it wouldn't make any sense to store the encryption key on the same media.

The encryption key is only stored in RAM. It is entered before mounting the encrypted filesystem. The key is typically derived from a passphrase typed by the user, but it can also be loaded from e.g. a smartcard. The kernel documentation has the details.

It is possible to store the encryption key for a volume in a file outside that volume, and load that. It can make sense to have a key on a removable drive that's inserted physically at boot time, for example. But the kernel won't do this on its own, it's up to the system's startup scripts to do that.

2

The documentation on the kernel keyring can be find in the kernel source tree:

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/Documentation/security

The keys used for eCryptfs are not stored on disk in plaintext. The utilities in the ecryptfs-utils project default to wrapping keys with a user supplied passphrase before saving any key material to disk. The user supplied passphrase is required to be entered by the user after each boot.

  • If I could -1 I would. a) It doesn't answer the question, it answers a different question no one asked about ecryptfs passphrases b) it just links to documentation. – Pod Dec 15 '16 at 16:54
0

My own notes on using the kernel keyring and using it via "keyctl"

http://www.ict.griffith.edu.au/anthony/info/crypto/passwd_caching.txt

I did this to store passwords when editing encrypted files!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.