Dm-Crypt system encryption with different keys per user

Question

I have found the following example configuration for a system encryption:

Example 5: paranoid system encryption

• whole hard drive encrypted with dm-crypt+LUKS
   └──> unlocked before boot, using dedicated passphrase + USB stick with keyfile
        (different one issued to each user - independently revocable)
• /boot partition located on aforementioned USB stick

However I didn't find any details.

Does it mean that it is possible to have a full system encryption where each user partition has its own passphrase such that for example when one user is logged in, he cannot read the data of another user who is not logged in because his data is encrypted? (Similar as it would be the case if you encrypt different home partitions with ecryptfs).

So can somebody provide some details how this works in practice and how to set it up in an ubuntu system?

Answer 1

If you want a per user encryption, Ubuntu already offers a solution for that I believe. It doesn't use dm-crypt/luks but ecryptfs or similar, to encrypt each users home directory individually, using an encrypted layer on top of the regular filesystem.

As for dm-crypt/luks, you'd have to create a separate partition or logical volume for each user to achieve the same thing.

Another possibility is that it's referring to LUKS supporting multiple keys for the same container. However, that's limited to 8 key slots, so that's not very practical unless your number of users is that small.

You could also set up a chained system - give the user a key that unlocks a master key which in turn unlocks the container. I don't think it's really suitable for user management though - it may be useful if you want to prevent theft/loss of USB stick == loss of key.