keymgr

func AddRecoveryKeyToLUKSDevice ¶

func AddRecoveryKeyToLUKSDevice(recoveryKey keys.RecoveryKey, dev string) error

AddRecoveryKeyToLUKSDevice adds a recovery key to a LUKS2 device. It the devuce unlock key from the user keyring to authorize the change. The recoveyry key is added to keyslot 1.

func AddRecoveryKeyToLUKSDeviceUsingKey ¶

func AddRecoveryKeyToLUKSDeviceUsingKey(recoveryKey keys.RecoveryKey, currKey keys.EncryptionKey, dev string) error

AddRecoveryKeyToLUKSDeviceUsingKey adds a recovery key rkey to the existing LUKS encrypted volume on the block device given by node. The existing key to the encrypted volume is provided in the key argument and used to authorize the operation.

A heuristic memory cost is used.

func IsKeyslotAlreadyUsed ¶

func IsKeyslotAlreadyUsed(err error) bool

IsKeyslotAlreadyUsed returns true if the error indicates that the keyslot attempted for a given key is already used

func RemoveRecoveryKeyFromLUKSDevice ¶

func RemoveRecoveryKeyFromLUKSDevice(dev string) error

RemoveRecoveryKeyFromLUKSDevice removes an existing recovery key a LUKS2 device.

func RemoveRecoveryKeyFromLUKSDeviceUsingKey ¶

func RemoveRecoveryKeyFromLUKSDeviceUsingKey(currKey keys.EncryptionKey, dev string) error

RemoveRecoveryKeyFromLUKSDeviceUsingKey removes an existing recovery key a LUKS2 using the provided key to authorize the operation.

func StageLUKSDeviceEncryptionKeyChange ¶

func StageLUKSDeviceEncryptionKeyChange(newKey keys.EncryptionKey, dev string) error

StageLUKSDeviceEncryptionKeyChange stages a new encryption key with the goal of changing the main encryption key referenced in keyslot 0. The operation is authorized using the key that unlocked the device and is stored in the keyring (as it happens during factory reset).

func TransitionLUKSDeviceEncryptionKeyChange ¶

func TransitionLUKSDeviceEncryptionKeyChange(newKey keys.EncryptionKey, dev string) error

TransitionLUKSDeviceEncryptionKeyChange completes the main encryption key change to the new key provided in the parameters. The new key must have been staged before, thus it can authorize LUKS operations. Lastly, the unlock key in the keyring is updated to the new key.