March 2021 - cypherpunks - lists.cpunks.org

Covid Crazies
by coderman 20 Jun '21

20 Jun '21

when thinking of usability of security features, i always wonder about diminished mental states - how do you handle authentication when the mind is unstable? (biometrics work, but they cannot be the whole piece. e.g. scanning a dead finger...) --- https://www.nytimes.com/2020/12/28/health/covid-psychosis-mental.html Small Number of Covid Patients Develop Severe Psychotic Symptoms Most had no history of mental illness and became psychotic weeks after contracting the virus. Cases are expected to remain rare but are being reported worldwide. Almost immediately, Dr. Hisam Goueli could tell that the patient who came to his psychiatric hospital on Long Island this summer was unusual. The patient, a 42-year-old physical therapist and mother of four young children, had never had psychiatric symptoms or any family history of mental illness. Yet there she was, sitting at a table in a beige-walled room at South Oaks Hospital in Amityville, N.Y., sobbing and saying that she kept seeing her children, ages 2 to 10, being gruesomely murdered and that she herself had crafted plans to kill them. “It was like she was experiencing a movie, like ‘Kill Bill,’” Dr. Goueli, a psychiatrist, said. The patient described one of her children being run over by a truck and another decapitated. “It’s a horrifying thing that here’s this well-accomplished woman and she’s like ‘I love my kids, and I don’t know why I feel this way that I want to decapitate them,’” he said. The only notable thing about her medical history was that the woman, who declined to be interviewed but allowed Dr. Goueli to describe her case, had become infected with the coronavirus in the spring. She had experienced only mild physical symptoms from the virus, but, months later, she heard a voice that first told her to kill herself and then told her to kill her children. At South Oaks, which has an inpatient psychiatric treatment program for Covid-19 patients, Dr. Goueli was unsure whether the coronavirus was connected to the woman’s psychological symptoms. “Maybe this is Covid-related, maybe it’s not,” he recalled thinking. - Thanks for reading The Times. [Subscribe to The Times](https://www.nytimes.com/subscription?campaignId=9L9L9) “But then,” he said, “we saw a second case, a third case and a fourth case, and we’re like, ‘There’s something happening.’” Indeed, doctors are reporting similar cases across the country and around the world. A small number of Covid patients who had never experienced mental health problems are developing severe psychotic symptoms weeks after contracting the coronavirus. In interviews and scientific articles, doctors described: A 36-year-old nursing home employee in North Carolina who became so paranoid that she believed her three children would be kidnapped and, to save them, tried to pass them through a fast-food restaurant’s drive-through window. A 30-year-old construction worker in New York City who became so delusional that he imagined his cousin was going to murder him, and, to protect himself, he tried to strangle his cousin in bed. Advertisement [Continue reading the main story](https://www.nytimes.com/2020/12/28/health/covid-psychosis-mental.htm… A 55-year-old woman in Britain had hallucinations of monkeys and a lion and became convinced a family member had been replaced by an impostor. Beyond individual reports, a British [study of neurological or psychiatric complications](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7316461/) in 153 patients hospitalized with Covid-19 found that 10 people had “new-onset psychosis.” Another study identified [10 such patients in one hospital in Spain](https://www.sciencedirect.com/science/article/pii/S0165178120315092?…. And in Covid-related social media groups, medical professionals discuss seeing patients with similar symptoms in the Midwest, Great Plains and elsewhere. “My guess is any place that is seeing Covid is probably seeing this,” said Dr. Colin Smith at Duke University Medical Center in Durham, who helped treat the North Carolina woman. He and other doctors said their patients were too fragile to be asked whether they wanted to be interviewed for this article, but some, including the [North Carolina woman](https://casereports.bmj.com/content/13/8/e236940), agreed to have their cases described in scientific papers. Medical experts say they expect that such extreme psychiatric dysfunction will affect only a small proportion of patients. But the cases are considered examples of another way the Covid-19 disease process can affect mental health and brain function. In Her Words: Where women rule the headlines. Although the coronavirus was initially thought primarily to cause respiratory distress, there is now ample evidence of many other symptoms, including [neurological](https://www.nytimes.com/2020/10/05/health/Covid-patients-ment…, cognitive and psychological effects, that could emerge even in patients who didn’t develop serious lung, heart or circulatory problems. Such symptoms can be just as debilitating to a person’s ability to function and work, and it’s often unclear [how long they will last or how to treat them](https://www.nytimes.com/2020/12/04/health/covid-long-term-symptoms.ht…. Experts increasingly believe brain-related effects may be linked to the body’s immune system response to the coronavirus and possibly to vascular problems or surges of inflammation caused by the disease process. “Some of the neurotoxins that are reactions to immune activation can go to the brain, through the blood-brain barrier, and can induce this damage,” said Dr. Vilma Gabbay, a co-director of the Psychiatry Research Institute at Montefiore Einstein in the Bronx. Brain scans, spinal fluid analyses and other tests didn’t find any brain infection, said Dr. Gabbay, whose hospital has treated [two patients](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7414775/?fbclid=IwAR… with post-Covid psychosis: a 49-year-old man who heard voices and believed he was the devil and a 34-year-old woman who began carrying a knife, disrobing in front of strangers and putting hand sanitizer in her food. Physically, most of these patients didn’t get very sick from Covid-19, reports indicate. The patients that Dr. Goueli treated experienced no respiratory problems, but they did have subtle neurological symptoms like hand tingling, vertigo, headaches or diminished smell. Then, two weeks to several months later, he said, they “develop this profound psychosis, which is really dangerous and scary to all of the people around them.” Also striking is that most patients have been in their 30s, 40s and 50s. “It’s very rare for you to develop this type of psychosis in this age range,” Dr. Goueli said, since such symptoms more typically accompany schizophrenia in young people or dementia in older patients. And some patients — like the physical therapist who took herself to the hospital — understood something was wrong, while usually “people with psychosis don’t have an insight that they’ve lost touch with reality.” Some post-Covid patients who developed psychosis needed weeks of hospitalization in which doctors tried different medications before finding one that helped. Dr. Robert Yolken, a neurovirology expert at Johns Hopkins University School of Medicine in Baltimore, said that although people might recover physically from Covid-19, in some cases their immune systems, might be unable to shut down or might remain engaged because of “delayed clearance of a small amount of virus.” Persistent immune activation is also a leading explanation for [brain fog](https://www.nytimes.com/2020/10/11/health/covid-survivors.html)and memory problems bedeviling many Covid survivors, and Emily Severance, a schizophrenia expert at Johns Hopkins, said post-Covid cognitive and psychiatric effects might result from “something similar happening in the brain.” It may hinge on which brain region the immune response affects, Dr. Yolken said, adding, “some people have neurological symptoms, some people psychiatric and many people have a combination.” Experts don’t know whether genetic makeup or perhaps an undetected predisposition for psychiatric illness put some people at greater risk. Dr. Brian Kincaid, medical director of psychiatric emergency department services at Duke, said the North Carolina woman once had a skin reaction to another virus, which might suggest her immune system responds zealously to viral infections. Sporadic cases of post-infectious psychosis and mania have occurred with other viruses, including the 1918 flu and the coronaviruses SARS and MERS. “We think that it’s not unique to Covid,” said Dr. Jonathan Alpert, chairman of psychiatry and behavioral sciences at Albert Einstein College of Medicine, who co-wrote the report on the Montefiore patients. He said studying these cases might help to increase doctors’ understanding of psychosis. The symptoms have ranged widely, some surprisingly severe for a first psychotic episode, experts said. Dr. Goueli said a 46-year-old pharmacy technician, whose family brought her in after she became fearful that evil spirits had invaded her home, “cried literally for four days” in the hospital. He said the 30-year-old construction worker, brought to the hospital by the police, became “extremely violent,” dismantling a hospital radiator and using its parts and his shoes to try to break out of a window. He also swung a chair at hospital staff. How long the psychosis lasted and patients’ response to treatment has varied. The woman in Britain — whose symptoms included paranoia about the color red and terror that nurses were devils who would harm her and a family member — took about 40 days to recover, according to [a case report](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7477483/#:~:text=To%20…. The 49-year-old man treated at Montefiore was discharged after several weeks’ hospitalization, but “he was still struggling two months out” and required readmission, Dr. Gabbay said. The North Carolina woman, who was convinced that cellphones were tracking her and that her partner would steal her pandemic stimulus money, didn’t improve with the first medication, said Dr. Jonathan Komisar at Duke, who said doctors initially thought her symptoms reflected bipolar disorder. “When we began to realize that maybe this isn’t going to resolve immediately,” he said, she was given an antipsychotic, risperidone and discharged in a week. The physical therapist who planned to murder her children had more difficulty. “Every day, she was getting worse,” Dr. Goueli said. “We tried probably eight different medicines,” including antidepressants, antipsychotics and lithium. “She was so ill that we were considering electroconvulsive therapy for her because nothing was working.” About two weeks into her hospitalization, she couldn’t remember what her 2-year-old looked like. Calls with family were heartbreaking because “‘You could hear one in the background saying ‘When is Mom coming home?’” Dr. Goueli said. “That brought her a lot of shame because she was like, ‘I can’t be around my kids and here they are loving me.’” Ultimately, risperidone proved effective and after four weeks, she returned home to her family, “95 percent perfect,” he said. “We don’t know what the natural course of this is,” Dr. Goueli said. “Does this eventually go away? Do people get better? How long does that normally take? And are you then more prone to have other psychiatric issues as a result? There are just so many unanswered questions.”

6 14

Phys.org: Breaking the warp barrier for faster-than-light travel
by jim bell 30 May '21

30 May '21

Phys.org: Breaking the warp barrier for faster-than-light travel. https://phys.org/news/2021-03-warp-barrier-faster-than-light.html Jim Bell's comment:. Not quite 'Star Trek' level, but...

2 1

Cryptocurrency: Costs of Fiat are Unsustainable Not Crypto, VZ Bitcoin Satellite, CloudFlare
by grarpamp 03 May '21

03 May '21

On 9/26/20, Stefan Claas <sac(a)300baud.de> wrote: >> https://decrypt.co/43000/no-internet-no-problem-venezuela-gets-bitcoin-sate… It's also uplifting to see the speed that some of the crypto food, charity, and monetary networks are able to help provide options and solutions to troubled regions. The libertarian sort of nature of cryptocurrency will continue making larger impacts as time goes on. And thanks to decrypt.co for not using CloudFlare to block Tor users from reading their site. Too many crypto news aggregators and crypto services sites seem perhaps not aware of what their CloudFlare settings are doing in that regard. That's the whole point with satellite, privacy coins, etc... to route around silly censorship blocking. If people like decrypt.co, send them some satoshi for bandwidth, and get them setup with their own .onion / .i2p. > I must say congrats to Venezuela for the idea to > communicate via a satellite in space, > when Internet connectivity sucks. Yes, the leading distributed permissionless uncensorable privacy cryptos are all making cool progress in Venezuela, and in satcom and other comms, as posted in various fora... https://old.reddit.com/r/Bitcoin+Bitcoincash+CryptoCurrencies+CryptoCurrenc… https://lists.cpunks.org/pipermail/cypherpunks/2020-September/082278.html > While I must admit that I am no longer a fan of crypto > currencies (huge global energy resources waste IMHO) And what analysis are people basing that on? It is clear that people are forgetting to add up ALL of the global resources wasted on supporting Fiat Currencies. That is an understandable oversight given that all of the major media and fraudulent anti-crypto "research" reporting on "energy resource waste"... (their analysis is funded by obsolete Banks Governments Corporations all dependant on each other to exist in Fiat)... typically only adds up the mining costs, and fails to do a comparison to Fiat at all, let alone a high quality honest comparison that strives to include... ALL of the... Electricity used by paper bill printing and coin stamping machines globally. All their shredders and smelters and mining and tree sawing and paper making chemical processes deforestation, the distribution channels, and gasoline, diesel, coal, oil, lubrication, maintenance. Pollution costs, lung cancer costs, physical waste costs. Safe storage and transport costs for "money". Printing employee costs, wasted closed market government dictated health care costs. Cash register, security cam, alarm systems electricity. And all that and *much* more is just for physicality of producing and handling with it. Then they did also forget to add up ALL the Bank building costs, maintenance, daily commute costs, wear on and pollution from their tires. The cost fees they steal from you to "hold" your money and move it around for you, 2 and 20 management, and the costs to get it back when they censor and lock your flow. All their computers on their desks, all their lights, all the electricity and chems used to process their feces that flow down their toilet sewers before it hits the river, oopsie. They forgot ALL the existence of Government "laws" around money... all the "law" editors, publishers, glitzy marble government buildings, $170k/year salary that Government "representatives" steal from you to waste hours debating Fiat on their floors, and dabbling in politically immune corruption. Cost of all the Fiat Bank lobbyists, their air travel, and so much more. Cost of prisons and loss of all your assets and property for using it to buy and sell harmless plants, or to exchange cryptocurrencies with each other without a "license". Then add up the entirely Government "leader" initiated WARS over monetary trade imbalances, to take out other "leaders" and easy centralized Fiat targets. Their epic initiations of murderous immoral force to steal more resources and trap up people to fund the "growth" needed to offset the crippling debt inherent with how Fiat is created by Central Banks and Govt without imploding. Go ahead... add it all up, ALL OF IT, all that wasted energy in the entire Global System of Fiat that is rapidly becoming obsolete by cryptocurrency. Fiat currency is so wasteful that it makes even a world based only on Gold and Silver, sans Govt involvement, look resource cheap in comparison to Fiat's all-in costs. Nor do people realize that in the long term, cryptocurrency can, does, and will run on little more, relatively speaking in comparison, than sand (silicon) and solar power. In fact, solar's free clean renewable input will be among few competitive ways remaining, with wind, and nuclear a bit more. And without Government in the way propping up energy legacies, and with open markets and self and other unsystem schooling options, uncensored peer to peer comms around the world, allowing people to see through GovCorp secrets and lies, and make new enlightened choices for their own Earth environment... crypto continues to look very good. Anyone trying to step to cryptocurrency talking the typical dishonest limited scope "energy waste" weaksauce will get destroyed by even armchair estimates of all-in costs.

4 6

RedPill: Crypto Speech re 2ndA, Black Community Flips to Support Trump, Kyle Rittenhouse Defends from Thugs
by grarpamp 23 Apr '21

23 Apr '21

Cryptography depends on the 1st Amendment, Freedom of Speech depends on the 2nd, history shows all four of the above are under constant risk of being banned, and most of the world has already succeeded at it. https://www.youtube.com/watch?v=BbeBSp6KEDU 2ndA is Ending Exclusion of Minorities from Their Rights, Racist Biden Exposed https://www.youtube.com/watch?v=wFo59MOxN-8 Bryson Gray on Why I Left the Left https://www.youtube.com/watch?v=z4bFl0SLKQQ Kamala Harris Mission to Destroy Freedom, Supports Theft and Violent Force https://www.youtube.com/watch?v=RgC1yrWRNo0 Gun Control Doesn't Work https://www.youtube.com/watch?v=o3rzyqr4cbw Colion Noir: Nuanced Perspectives... BLM Marxists https://www.youtube.com/watch?v=c5D5cyS0Xzg Chicago Lightfoot is Incompetent Lying Two-Faced https://www.youtube.com/watch?v=rQhsxgx-h2M Ava Flanell on How She Got In https://www.youtube.com/watch?v=Xpzl9IQHc9s Gun Totin Patriot by Bryson Gray "If ya wanna come and get my rifle... good luck." https://www.youtube.com/watch?v=NKus9Euv7UI Kyle Rittenhouse Defends Self 1x https://www.youtube.com/watch?v=iryQSpxSlrg Kyle Rittenhouse Defends Self 2x 3x https://www.youtube.com/watch?v=qKlmbM03IQI Trump Remarks on Kyle Case https://www.youtube.com/watch?v=v_4r_3D5TVI Internet Summary via ClownWorld https://www.youtube.com/watch?v=twSYsZfL5QY Kyle Speaks From Jail via @CaliKidJMP Rittenhouse Defense https://fightback.law/ https://mobile.twitter.com/LLinWood https://mobile.twitter.com/CaliKidJMP https://mobile.twitter.com/michellemalkin https://mobile.twitter.com/MarinaMedvin https://www.thegatewaypundit.com/2020/08/kyle-rittenhouse-working-lifeguard… https://i.imgur.com/C9vfdvK.jpg On Amendments 2 and 1 https://old.reddit.com/r/DIYGuns+Firearms+gunpolitics+progun+secondamendmen… Meanwhile, co geriatric and cognitive declinee partner to Joe Biden, Nancy Pelosi whines about her hair and plots how to force you to wear masks... https://www.zerohedge.com/political/it-was-setup-pelosi-blames-salon-covert… Same as with guns, Nancy Pelosi and the Democrats definitely DO NOT want you to own, use, and develop any cryptography munitions privacy, or 3-D printing technology, either. More Crypto munitions coming soon...

1 1

Cypherpunks: There Are None Here (ex: Privacy 1984: Predictive Policing on the Rise)
by grarpamp 19 Apr '21

19 Apr '21

> grarpamp, your posts are awesome work! Thank you. My posts, while noting obvious news for those without insight, are otherwise complete garbage, and are rightly offtopic filtered straight to trash by most. Further, hardly any discussions ever ensue from anyone's post, quite a very sad state of affairs given the variety of relatively charter relavant topics posted by whoever, for which 90% of your posts are completely offtopic and should be shitcanned by readers as such. Anyway, it is quite reasonably doubtful that any so called "Cypherpunks" or "Crypto Anarchists" or even any lesser Libertarians even exist here, at least effectively none who are remotely capable of bringing that game out to the public speaking activism sphere on how, among other things, that Peace Love and Crypto-Anarchism could work to bring a better world regarding any number of charter related topics, perhaps starting with simple AnCap Voluntaryism, or even just basic An-*. No, the list is more full of disgustingly silent Leeches, Journos searching for their next story, harvesting bots, sadistic Agents looking for their next entrapped life ruining and pointless bust, and GovCorp surveillance to preempt game and get 1-up headoff lead on future developments in history. > prayer, or more prayer Prayer is for the meek who shall not inherit anything in this Earth but their own sheepledom. Cypherpunks are not sheep, they write code and execute [on] program. Stop being fucking sheep.

4 4

Li-ion battery costs.
by jim bell 09 Apr '21

09 Apr '21

https://techxplore.com/news/2021-03-reveals-plunge-lithium-ion-battery.html I've been following magnesium-ion batteries for a few years.

3 3

Ron Paul: US 2nd Amendment In The Firing Line
by grarpamp 04 Apr '21

04 Apr '21

http://ronpaulinstitute.org/archives/featured-articles/2021/march/29/second… Authored by Ron Paul via The Ron Paul Institute for Peace & Prosperity, Gun control was already a Biden Administration priority before the recent shootings in Georgia, Colorado, and Virginia. In fact, the House of Representatives passed two gun-control bills weeks before the shootings. One of the House-passed bills expands background checks to include private sales, including those made at gun shows. Under this bill, someone who is not a licensed federal firearms dealer cannot sell a firearm without first relinquishing it to a federally-licensed dealer. The dealer must then conduct a background check on the prospective purchaser. The second bill allows the federal government to indefinitely delay a background check, thus indefinitely delaying a gun purchase. Other legislation introduced in Congress would create a national firearms registry, which would only facilitate gun confiscation. This same legislation would forbid anyone under 21 from owning a gun. The ban does not apply to the military, so it will not stop the majority of gun violence committed by 18-21 year-olds. The bill requires Americans to obtain a federal license before getting a firearm, but individuals cannot receive a license unless they undergo a psychological evaluation. The psychological evaluation mandate could lead to individuals losing their Second Amendment rights because they once suffered from depression. It could also cause people to lose their Second Amendment rights because someone told the police they may become violent. Police officers in 20 states and the District of Columbia already have the authority to take away an individual’s Second Amendment rights based on allegations and without giving the individual due process. These “Red Flag” laws are supported by politicians of both parties, including some who claim to be pro-gun rights. For example, former President Trump supported Red Flag laws. President Trump and Congressional Democrats were on the verge of reaching a “bipartisan” deal to expand Red Flag laws in the fall of 2019. Fortunately, the Democrat attempt to impeach the President ended all efforts at “bipartisan” deals to take away our rights. A psychological evaluation could also be used to deny an individual Second Amendment rights because they may engage in “domestic terrorism.” Among those likely to be considered as potential “domestic terrorists” are opponents of US foreign policy, mass surveillance, the income tax, the Federal Reserve, and – ironically – gun control. There is also legislation to reinstate the assault-weapons ban. Like the original ban, which was in effect from 1994-2004, the new legislation bans an arbitrary list of firearms and will do little to reduce gun violence. Criminals and psychotics are not going to be deterred by background checks and licensing requirements from obtaining a firearm. There will be a black market to service those who cannot obtain firearms by legal means. By discouraging law-abiding Americans from owning firearms, these laws leave millions of Americans defenseless against gun violence. There is a reason why most mass shootings occur in gun-free zones. If Congress is serious about protecting Americans from violence, it would repeal all federal gun control laws. A good place to start would be with the Brady background check law and the misnamed “Safe and Gun-Free Schools” law, which leaves children defenseless against mass shooters. Congress ending the unconstitutional and anti-liberty war on drugs would also greatly reduce gun violence. Gun control, like all attempts by government to control our lives, makes us less safe, and less free.

1 2

VICE: US ‘Broadband’ Joke, Guerilla MeshNets Fiber/RF Community P2P NOW!
by grarpamp 03 Apr '21

03 Apr '21

On 3/10/21, jim bell <jdb10987(a)yahoo.com> wrote: > VICE: The US Definition of ‘Broadband’ Is a Joke. > https://www.vice.com/en/article/k7av3n/the-us-definition-of-broadband-is-a-… “For years, we have seen billions in taxpayer dollars subsidize network deployments that are outdated as soon as they are complete, lacking in capacity and failing to replace inadequate broadband infrastructure,” Senator Michael Bennet wrote. “We need a new approach.” Yes the approach is called get the Govt and Corps out of the internet biz. Get with your neighbors and voluntarily lay your own guerilla fiber, peer to peer, owned parcel to owned parcel, across communities, farms, rivers, oceans, around the globe. Half the cost, twice the speed, encrypted, distributed uncensorable piecewise ownership and maintenance. You should have done it decades ago the moment meshnets became possible. Quit begging and paying at feet of GovCorp to keep putting you under their net servitude, spyveillance, and ongoing theft of your monthly $dollars into their political and profit coffers further propping up their powers over you stupid sheeple... wake up! Fiber is cheap, switches and RF and 1G/10G ports and even PON are all cheap cheap cheap distributed onetime investments paid for by as each neighbors node cuts the monthly GovCorp cord, shovels and beer and pizza are cheap, and opensource unix OS and routing protocols are free... less than one year of GovCorp monthly internet fee$... under $1000... gets you at least 10 years of 10Gig multihomed redundant link to two different neighbors... instant filesharing and voice video calls gaming and servers among all local peers, as the network grows to surpass traditional internet... go knock your neighbor's door and start building it, together. Ebay... Intel X520-DA2 10Gb 10Gbe 10 Gigabit Network Adapter NIC Dual Port E10G42BTDA $100 1 KM/1000M FTTH Indoor/Outdoor Single Mode 2-Core, Flat Aerial GPON Fiber $340 Board computer, tooling, boxes, etc ... It's that fucking cheap, one time, per node, wake up!!! The net slavery GovCorp is trapping you under does NOT end well. Escape it. Build it, Yourselves, Now!

1 3

GNU FSF: Richard Stallman Returns
by grarpamp 03 Apr '21

03 Apr '21

https://rms-support-letter.github.io/ https://github.com/rms-support-letter/rms-support-letter.github.io/ Petition for freespeech, against cancel culture...

7 10

Unlocking LUKS2 volumes with TPM2, FIDO2, PKCS#11 Security Hardware on systemd 248
by coderman 31 Mar '21

31 Mar '21

[Unlocking LUKS2 volumes with TPM2, FIDO2, PKCS#11 Security Hardware on systemd 248](http://0pointer.net/blog/unlocking-luks2-volumes-with-tpm2-fido2-pkcs1… TL;DR: It's now easy to unlock your LUKS2 volume with a FIDO2 security token (e.g. YubiKey or Nitrokey FIDO2). And TPM2 unlocking is easy now too. Blogging is a lot of work, and a lot less fun than hacking. I mostly focus on the latter because of that, but from time to time I guess stuff is just too interesting to not be blogged about. Hence here, finally, another blog story about exciting new features in systemd. With the upcoming systemd v248 the [systemd-cryptsetup](https://www.freedesktop.org/software/systemd/man/system… component of systemd (which is responsible for assembling encrypted volumes during boot) gained direct support for unlocking encrypted storage with three types of security hardware: - Unlocking with FIDO2 security tokens (well, at least with those which implement the hmac-secret extension, most do). i.e. your YubiKeys (series 5 and above), or Nitrokey FIDO2 and such. - Unlocking with TPM2 security chips (pretty ubiquitous on non-budget PCs/laptops/…) - Unlocking with PKCS#11 security tokens, i.e. your smartcards and older YubiKeys (the ones that implement PIV). (Strictly speaking this was supported on older systemd already, but was a lot more "manual".) For completeness' sake, let's keep in mind that the component also allows unlocking with these more traditional mechanisms: - Unlocking interactively with a user-entered passphrase (i.e. the way most people probably already deploy it, supported since about forever) - Unlocking via key file on disk (optionally on removable media plugged in at boot), supported since forever. - Unlocking via a key acquired through trivial AF_UNIX/SOCK_STREAM socket IPC. (Also new in v248) - Unlocking via recovery keys. These are pretty much the same thing as a regular passphrase (and in fact can be entered wherever a passphrase is requested) — the main difference being that they are always generated by the computer, and thus have guaranteed high entropy, typically higher than user-chosen passphrases. They are generated in a way they are easy to type, in many cases even if the local key map is misconfigured. (Also new in v248) In this blog story, let's focus on the first three items, i.e. those that talk to specific types of hardware for implementing unlocking. To make working with security tokens and TPM2 easy, a new, small tool was added to the systemd tool set: [systemd-cryptenroll](https://www.freedesktop.org/software/systemd/man/syste…. It's only purpose is to make it easy to enroll your security token/chip of choice into an encrypted volume. It works with any LUKS2 volume, and embeds a tiny bit of meta-information into the LUKS2 header with parameters necessary for the unlock operation. Unlocking with FIDO2 So, let's see how this fits together in the FIDO2 case. Most likely this is what you want to use if you have one of these fancy FIDO2 tokens (which need to implement the hmac-secret extension, as mentioned). Let's say you already have your LUKS2 volume set up, and previously unlocked it with a simple passphrase. Plug in your token, and run: # systemd-cryptenroll --fido2-device = auto /dev/sda5 (Replace /dev/sda5 with the underlying block device of your volume). This will enroll the key as an additional way to unlock the volume, and embeds all necessary information for it in the LUKS2 volume header. Before we can unlock the volume with this at boot, we need to allow FIDO2 unlocking via [/etc/crypttab](https://www.freedesktop.org/software/systemd/man/crypttab.html). For that, find the right entry for your volume in that file, and edit it like so: myvolume /dev/sda5 - fido2-device=auto Replace myvolume and /dev/sda5 with the right volume name, and underlying device of course. Key here is the fido2-device=auto option you need to add to the fourth column in the file. It tells systemd-cryptsetup to use the FIDO2 metadata now embedded in the LUKS2 header, wait for the FIDO2 token to be plugged in at boot (utilizing systemd-udevd, …) and unlock the volume with it. And that's it already. Easy-peasy, no? Note that all of this doesn't modify the FIDO2 token itself in any way. Moreover you can enroll the same token in as many volumes as you like. Since all enrollment information is stored in the LUKS2 header (and not on the token) there are no bounds on any of this. (OK, well, admittedly, there's a cap on LUKS2 key slots per volume, i.e. you can't enroll more than a bunch of keys per volume.) Unlocking with PKCS#11 Let's now have a closer look how the same works with a PKCS#11 compatible security token or smartcard. For this to work, you need a device that can store an RSA key pair. I figure most security tokens/smartcards that implement PIV qualify. How you actually get the keys onto the device might differ though. Here's how you do this for any YubiKey that implements the PIV feature: # ykman piv reset # ykman piv generate-key -a RSA2048 9d pubkey.pem # ykman piv generate-certificate --subject "Knobelei" 9d pubkey.pem # rm pubkey.pem (This chain of commands erases what was stored in PIV feature of your token before, be careful!) For tokens/smartcards from other vendors a different series of commands might work. Once you have a key pair on it, you can enroll it with a LUKS2 volume like so: # systemd-cryptenroll --pkcs11-token-uri = auto /dev/sda5 Just like the same command's invocation in the FIDO2 case this enrolls the security token as an additional way to unlock the volume, any passphrases you already have enrolled remain enrolled. For the PKCS#11 case you need to edit your /etc/crypttab entry like this: myvolume /dev/sda5 - pkcs11-uri=auto If you have a security token that implements both PKCS#11 PIV and FIDO2 I'd probably enroll it as FIDO2 device, given it's the more contemporary, future-proof standard. Moreover, it requires no special preparation in order to get an RSA key onto the device: FIDO2 keys typically just work. Unlocking with TPM2 Most modern (non-budget) PC hardware (and other kind of hardware too) nowadays comes with a TPM2 security chip. In many ways a TPM2 chip is a smartcard that is soldered onto the mainboard of your system. Unlike your usual USB-connected security tokens you thus cannot remove them from your PC, which means they address quite a different security scenario: they aren't immediately comparable to a physical key you can take with you that unlocks some door, but they are a key you leave at the door, but that refuses to be turned by anyone but you. Even though this sounds a lot weaker than the FIDO2/PKCS#11 model TPM2 still bring benefits for securing your systems: because the cryptographic key material stored in TPM2 devices cannot be extracted (at least that's the theory), if you bind your hard disk encryption to it, it means attackers cannot just copy your disk and analyze it offline — they always need access to the TPM2 chip too to have a chance to acquire the necessary cryptographic keys. Thus, they can still steal your whole PC and analyze it, but they cannot just copy the disk without you noticing and analyze the copy. Moreover, you can bind the ability to unlock the harddisk to specific software versions: for example you could say that only your trusted Fedora Linux can unlock the device, but not any arbitrary OS some hacker might boot from a USB stick they plugged in. Thus, if you trust your OS vendor, you can entrust storage unlocking to the vendor's OS together with your TPM2 device, and thus can be reasonably sure intruders cannot decrypt your data unless they both hack your OS vendor and steal/break your TPM2 chip. Here's how you enroll your LUKS2 volume with your TPM2 chip: # systemd-cryptenroll --tpm2-device = auto --tpm2-pcrs = 7 /dev/sda5 This looks almost as straightforward as the two earlier sytemd-cryptenroll command lines — if it wasn't for the --tpm2-pcrs= part. With that option you can specify to which TPM2 PCRs you want to bind the enrollment. TPM2 PCRs are a set of (typically 24) hash values that every TPM2 equipped system at boot calculates from all the software that is invoked during the boot sequence, in a secure, unfakable way (this is called "measurement"). If you bind unlocking to a specific value of a specific PCR you thus require the system has to follow the same sequence of software at boot to re-acquire the disk encryption key. Sounds complex? Well, that's because it is. For now, let's see how we have to modify your /etc/crypttab to unlock via TPM2: myvolume /dev/sda5 - tpm2-device=auto This part is easy again: the tpm2-device= option is what tells systemd-cryptsetup to use the TPM2 metadata from the LUKS2 header and to wait for the TPM2 device to show up. Bonus: Recovery Key Enrollment FIDO2, PKCS#11 and TPM2 security tokens and chips pair well with recovery keys: since you don't need to type in your password everyday anymore it makes sense to get rid of it, and instead enroll a high-entropy recovery key you then print out or scan off screen and store a safe, physical location. i.e. forget about good ol' passphrase-based unlocking, go for FIDO2 plus recovery key instead! Here's how you do it: # systemd-cryptenroll --recovery-key /dev/sda5 This will generate a key, enroll it in the LUKS2 volume, show it to you on screen and generate a QR code you may scan off screen if you like. The key has highest entropy, and can be entered wherever you can enter a passphrase. Because of that you don't have to modify /etc/crypttab to make the recovery key work. Future There's still plenty room for further improvement in all of this. In particular for the TPM2 case: what the text above doesn't really mention is that binding your encrypted volume unlocking to specific software versions (i.e. kernel + initrd + OS versions) actually sucks hard: if you naively update your system to newer versions you might lose access to your TPM2 enrolled keys (which isn't terrible, after all you did enroll a recovery key — right? — which you then can use to regain access). To solve this some more integration with distributions would be necessary: whenever they upgrade the system they'd have to make sure to enroll the TPM2 again — with the PCR hashes matching the new version. And whenever they remove an old version of the system they need to remove the old TPM2 enrollment. Alternatively TPM2 also knows a concept of signed PCR hash values. In this mode the distro could just ship a set of PCR signatures which would unlock the TPM2 keys. (But quite frankly I don't really see the point: whether you drop in a signature file on each system update, or enroll a new set of PCR hashes in the LUKS2 header doesn't make much of a difference). Either way, to make TPM2 enrollment smooth some more integration work with your distribution's system update mechanisms need to happen. And yes, because of this OS updating complexity the example above — where I referenced your trusty Fedora Linux — doesn't actually work IRL (yet? hopefully…). Nothing updates the enrollment automatically after you initially enrolled it, hence after the first kernel/initrd update you have to manually re-enroll things again, and again, and again … after every update. The TPM2 could also be used for other kinds of key policies, we might look into adding later too. For example, Windows uses TPM2 stuff to allow short (4 digits or so) "PINs" for unlocking the harddisk, i.e. kind of a low-entropy password you type in. The reason this is reasonably safe is that in this case the PIN is passed to the TPM2 which enforces that not more than some limited amount of unlock attempts may be made within some time frame, and that after too many attempts the PIN is invalidated altogether. Thus making dictionary attacks harder (which would normally be easier given the short length of the PINs). Postscript (BTW: Yubico sent me two YubiKeys for testing and Nitrokey a Nitrokey FIDO2, thank you! — That's why you see all those references to YubiKey/Nitrokey devices in the text above: it's the hardware I had to test this with. That said, I also tested the FIDO2 stuff with a SoloKey I bought, where it also worked fine. And yes, you!, other vendors!, who might be reading this, please send me your security tokens for free, too, and I might test things with them as well. No promises though. And I am not going to give them back, if you do, sorry. ;-))

1 0