Bash file to generate luks key in Grub

Question

I'm using Luks to encrypt my hard drive along with Grub and initramfs. I don't want to leave any doubt in that e.g. someone could take out my SSD, put it into something else or clone it and then try to get into it.

So at the moment I have a static keyfile and a password. To help with this, I would like to have a bash file which generates a hash returned as the keyfile, which consists of UUID + random salt/key + either the unhashed password of luks, or some other hashed password only accessible on that physical machine.

The reason I say unhashed is because I don't want anything retrieving from the headers which may be of use to anyone, and I feel these three things would be strong enough to make any attach my taking my hardware out worthless. And this way even if someone found the key file (which weirdly happened to me once when I got dropped into an emergency shell) it would basically be useless to them.

I can write the bash script to do this and the same for changing the luks password however the part I'm struggling with is on the end of Grub because at the moment I'm using GRUB_CMDLINE_LINUX and specifically cryptkey=rootfs:/path/to/file and this would need to execute the bash script.

And in case of initramfs, I'm using FILES in /etc/mkinitcpio.conf.

Is this even possible or would I be needing something else to try and accomplish this? I'm a bit unsure about this aspect and can't find anything substantive.

Thanks in advance.

Answer 1

I don't think this is possible with GRUB_CMDLINE_LINUX or initramfs. You could use a pre-boot authentication (PBA) tool like TrustedGRUB, which can be used to run a script from a USB drive, but then you'd be relying on the integrity of the USB drive, which is not necessarily secure.

Another option would be to use a keyfile stored on a secure element, such as a YubiKey. This would be more secure than using a USB drive, as it is much less vulnerable to physical attacks.