I think I figured out today, this is the first time I've been in the world for a long time.
All right, for the next talk, we have Richard telling us everything about how we finally
fixed police encryption.
And welcome Richard.
Thank you very much.
So, teeny bit about me.
I'm a distribution architect as soon as I've been doing this open sort of stuff for way too long.
I think I figured out today, this is my 13th first time, the other 12th went fine.
So, I guess this is all my everything's going to go wrong.
And yeah, I've been working at Suse of the 10 years and I created this distribution
called M, which I will talk a little bit about.
And then show how we've done for this encryption with all of the system detour chain on top of that.
And then talk about some of the rough edges we have left.
And then the whole plan was to have a nice Q&A open-for discussion with the handheld microphone,
which of course we haven't got in this room.
So, I'm just going to try and figure out a way of making that work with me copying everyone's questions for the recording.
So, Aeon, I have a talk about this in the digital room and stuff to mean.
But basically, it's not sure it's another one of these immutable desktop concepts.
Being reliable, predictable, immutable bit like microS from the server side of things.
But also being really opinionated, because this is my desktop and my daily driver.
So, not only very Chromebook-like experience, image-based installation,
keeping it pretty minimal for everybody else, but functional, you know, all the printing and gaming development stuff
should just work out of the box.
This was freshly installed last week and the presentation's working without me doing anything on it.
So, that's all good.
And really, we don't want people having to mess around with lots of funky configuration
to get the whole thing to work.
And that includes also for description.
So, last year July, we did release candidate 3, which was the one where we put FTE in there,
and it's enabled by default.
In fact, you can't turn it off.
If you're installing Aeon, you are getting full description if you like it or not.
By default, if your hardware supports it,
it's TPM backed and automatically unlocking.
And if your hardware doesn't, we have this concept of a fallback mode where you've got to put a passphrase in.
And, yeah, you know, you're unlocking it sort of old fashioned lots of way every time it boots up.
It's deployed calling it bare with a tool called tick.
Basically, a whole new installer that I wrote, because I felt like playing around with that kind of thing.
Really nothing more than it's a fancy graphical wrapper around system D-report.
If system D-report is actually doing all the hard work,
deploying the image, setting up the partitions,
configuring the encryption, doing all the luck stuff.
Everything that's remotely important gets done by system D-report.
And then all of the TPM measurements.
And, because this is a user style distribution, all the stitching with BTRFS subvolumes,
is done by a tool we have called SDPU-U2.
So, when you are deploying A on with tick, first or, in fact, any distribution of the tick,
but A on is the one you're using it right now.
We probably system to figure out, does it have policy authorised NV,
because that's what you need to do to get it working with PCI lock.
Then also checks for secure bit.
And then figure out what the heck is it going to do with those two different full description modes here.
Are you going to get a nice decent validated supplied boot chain,
where it's actually only going to unlock if your boot chain is good,
or are you just going to be shopping in a password?
So, if you have a good enough beta hardware with policy author and VNGTPM,
you get default mode, pretty much any other case, you get full back mode,
and if you're on a machine that doesn't have good enough hardware,
and you've turned off secure boot, you get full back mode with a grumpy warning,
because, you know, okay, secure boot isn't great, but it's better than nothing.
So, on at least people have people some concept of having some check over their boot chain
when they're starting up their system.
But typically speaking on a default mode, you know, I don't care with A on if secure boot is on or off.
I just care whatever you've picked stays the same because I'm measuring PCR7.
Like I said, tick avoid doing as much complicated work as it can itself.
So, because of these two different modes, you know,
because I'm doing TPM backed and traditional full description of the path raises,
it means I can't use system DV parts, instant TPM pairing.
So, system DV parts using a key file, so I have tick generate the key file,
and then basically I just take an image, read the system DV part config from that image,
and slap it on the disk, if you chose, it's part of the install.
Simple, easy works.
The typical system DV part config we're using is also incredibly simple, easy straightforward.
Like, I'm not the large EFI partition on purpose,
because I'm kind of expecting to move to UKI's one day.
So, I'd rather make every of my coven, one of the reasons I'm talking about this later,
like we're on RC3 as I kept on changing how big everybody's positions were.
Like, this way, I'm not going to have to deal that again.
I think I'm probably fine with four gig for a while,
and then everything else, I just take over the entire disk,
copying the blocks from the image, and encrypting that with the key file.
And then, after the image is deployed, there's a little bit of stitching to be done.
Of course, the image is being built in OBS.
I have had some experimental ones built with MKOSI.
The cover one is actually using kiwi, just because I know kiwi better.
I'm going to go back to the MKOSI one soon.
But either way, it's a generic image and, of course, your system isn't a generic system.
So, there's a bit of stitching required, you know,
correcting the FS tab to actually include the UIDs of the partition that's just deployed,
correcting the command line,
yeah, populated the crypto tab, that kind of stuff,
and then using FD but U2 to actually put system D but in the ESP,
and the Cardinals in the ID, because we're not using UKI.
So, it's just putting all of that stuff in there, separated.
Then, in default mode, there's a couple of extra steps,
because we're doing all this TPM pairing.
So, we can figure out PCR policy, which I'll talk about a bit more later,
and then update those predictions for the system, and enroll it into the TPM.
So, system D, SDP, U2, just reads that config,
and figures out the entries for every PCR I'm interested in,
and then system D cooked and roll, nicely simply pairs it all up,
and away we go.
And in full back mode, of course, none of that TPM stuff needed,
you just have to use it for a passphrase.
I decided, when I was doing this, for a TPM environment,
if you're TPM break, so you'll be a measurements don't match up,
you need to have a recovery key to get into the system unlock it manually,
and for feedback mode as well, I also kind of figured,
you know, users can be silly sometimes and forget their own passwords,
so generating a recovery key for everybody in every case all the time,
and then presenting it to them with a nice long string,
and a nice QR code that you can store on your phone or whatever,
to remember what's going on.
And then last, but definitely not least,
wiping that key further used for the, yeah,
to get the whole thing running, so the only keys that are enrolled in the end,
are your passphrase, all the recovery key, or the TPM.
And that's been how every single Ion user,
including myself, has been running their laptops since July,
and to be honest, it's been mostly painless.
It's just working, SD but you two are doing a wonderful job of every time
there's a system update updating all of the predictions.
Of course, we also have automatic rollbacks and failure detection,
and of course, system DB, you choose a way of that too,
so it'll even update the predictions when you roll back from user space,
which is really nice.
As I talk about in a bit, we did mess around with the PCR policy a bit,
so I did have to make it a little tool to go and check everybody's machine
to fix which PCR's are being checked,
but besides that, it's mostly just working.
But not 100% perfect.
So the first thing we had issues with is this lovely recovery key.
I don't know if this is just an SD but usual thing,
or also if it's system decrypt enroll,
but there's a whole bunch of effort taken to only use characters
which are all in the same location on everybody's keyboard,
which is awesome.
So, you know, German keyboard, I've got a German keyboard here,
but I type in English.
It's great, these French whatever,
the character set is ridiculously constrained,
so it's just the keys that don't move around
or all these different keyboard layouts.
Brilliant work.
Those make the string a little bit longer,
because you still want to have some entropy.
That's fine.
But we're using dashes to separate it,
and that's the one key that moves on every single keyboard layout.
Again?
They have no value, they do nothing.
When I drop the dashes,
it fails for me.
I'm doing something wrong.
Well, you have to use this as a new tool to do this
because they will drop the dashes for you.
Okay.
I've been with dashes a loop.
Consider that a password.
Yeah.
Okay.
Yeah.
You can type it in upper case and lower case and drop it that.
So, that's awesome.
Yeah.
My own implementation is the problem,
which is perfect.
Thank you very much.
Yes.
Well, I was going to just use spaces or something.
Yeah.
The question is why don't I just use point or something.
I could just use spaces.
I could also just do what system these doing with the tool.
So.
Yeah.
I know.
It's a little thing.
But it's the one that my users hit like so many times.
It's like, if this is the biggest problem,
we have really FTE is really doing well.
But this is the biggest problem we have.
Yeah.
Okay.
What the question is, why can't you just have your native keyboard layout running?
I'm, you know, we're very early in the group process here.
You know, like, you haven't unlocked, you haven't unlocked your disk yet.
So, you've got only got what you've got in your air, your ESP.
Yeah.
But when you type your key, you've generated your key.
So, you've stored that key in whatever keyboard layout you've done.
So, that's all fine.
In this case, this has been randomly generated by us.
So, if there's a mismatch, then, yeah.
One thing I would really, really like is multi-factor authentication.
But, you know, the only option we have for that right now is TPM and PIN.
And TPM and PIN is scary.
Not for anything that we control and software because we don't control that.
That's really what the manufacturers do.
And the other problem we have had with this has been how different manufacturers
with different firmware do things somewhat subtly differently.
And, you know, certainly I have someone's machine that the TPM just doesn't want to respond anymore.
And they do things never unlocks.
So, yeah.
The kind of open question is, are we really stuck with just, you know.
I know exactly what we need to do for the PIN file or stuff, which is what the Chromebooks do.
It's just somebody's simple like that.
So, what do the Chromebooks do?
They do it really nicely because the TPM basically asks the challenge to the file.
The thing, the file does a regular file or stuff like what it always does.
Yeah.
And then the TPM gets the signature back, right?
Yeah.
And then it will release the encryption key to the...
And that would all be in addition to all the other PCR checks that have done.
So, the comment was basically doing what the Chromebooks do.
So, having the TPM challenge and the photo key separately,
and then unlocking the only one both part.
Yeah.
That's fine.
That's good.
I'd like that.
And maybe I'll find time to do it.
But maybe not.
And so, yes.
There are PCR policy.
We started initially following what opens using microRFs was doing,
which is PCR 04579.
Well, I think I might have added.
It's about 44790 for sure.
Which, of course, was great apart from every time somebody did a firmware update.
Then PCR 0 and no longer matched because you've just changed your firmware.
And of course, with Alan, it's a desktop OS.
I have FFW update there with no software, and it was running all the time.
You know, reading the system decrypts at a box of a good starting point,
you know, it's recommended there to not measure PCR 0 for this kind of reason.
But I do always ask myself, you know, is this enough?
And of course, I wrote this like three weeks ago, and now there's a nice blog post.
It's telling me definitely probably not enough.
You know, there is cases like potentially.
You know, with a really strong way, basically the kind of potential bypass here is, you know,
some very fancy person could theoretically inject a different operating system,
kind of in front of your one.
So, you know, potentially you could end up booting into a different environment,
and you were expecting, but that environment still gets the keys unlocked, so we can still read your disk.
Where is the recommendation there is to, yeah, measure PCR 15.
System D has all this wonderful tooling for measuring lots of file system information,
and UUIDs and recovery keys and all that stuff.
And none of all that stuff only works if I'm using System D,
to stop with UKIs.
Is that really the one true way for, sort of, am I?
Why not go on with UKIs?
Yes, fine.
Well, the reason we haven't used UKIs up to now with A-on is, of course,
we're using BTRFS with a Susan-style fancy snapshotting and rollback.
So, every update to the system creates a new BTR snapshot,
the main magic with SD boot UTIL is basically creating boot entries in System D boot.
So, when your system no longer boots, you can pick a different boot entry to go to...
The reason to say no to UKIs, that's the reason why you want Type 1 and just, right?
So, my suggestion would always, like, you can use a Type 1 SD boot, like a BLS entry,
point it through UKIs, so you're basically...
Yep, so the answer was, you know, you could just have a Type 1 entry put it through UKIs,
but that UKIs has a command line that, you know, is signed to check, et cetera,
and with our snapshots, you know, we are typically changing the snapshot by changing that command line
to point to the different snapshot number, which...
Yeah.
What about UTIL?
What's it?
I can't do this.
Yeah.
We've got UTKI profiles.
Yeah.
I actually, I actually have an idea that I came up with while writing these slides,
which would basically just be creating a directory structure, you know,
on my system for each UKI version that I know the system's deployed.
So, you know, UKI version 1 points to this snapshot, and that's contained in the OS,
therefore when it boots find, and that means in user space I can do all the fancy rollbacks to whatever
snapshot I want, and a boot time I just have a list of UKIs, which would be simple and easy.
And actually, probably more sensible for our users, because most of the time when you're using that boot menu,
you're only trying to recover because your kernel's messed up.
So, booting to a slightly older snapshot with the same kernel is actually the worst thing.
Yeah.
Are you considering the potential to use snapshots?
Because you can still then, against the rollback of the VM, you're creating them locally.
I had...
I had the connection in the USB, and we used that.
So, I had no idea we could do that.
That's a cool idea.
The suggestion is like, why don't we use good entrances?
Yeah, that's an awesome idea.
I'll look into that.
I mean, this is the use case for...
Is this a credentials, right?
Like that you've put them locked to the TVM next to the kernel.
Now, in your cases, it's not going to work one to one, because you only want one kernel,
but it's 500 boot menu entries after all.
Yep.
So, we would probably...
There's a...
There's an issue open already about something like this, where you...
Well, no, you actually can use the global grid.
And to, like, we have a directory for global credentials, you can just stuff your...
No, you need the other way around.
Anyway, but...
Yeah, especially...
Yes, the discussion is going on.
We're precisely about your problem.
You get a issue.
Yeah.
It's really easy that you take a BLS1 thing that points to the UKI.
But then, also, we teach BLS101 to point to a credentials file, right?
So, and then, for every boot part of our press,
not sure that you have, you generate one credentials.
Yeah.
You have a dedicated information.
And then, one BLS1 entry that goes together with the UKI.
Yep.
That itself is not often indicated, but that's not a problem.
That's... Yeah.
So, yeah, that's what that answer is.
Sort it then.
So...
I'm expecting a patch about the new.
Yes, you can definitely get a patch from it.
I would definitely be looking at that.
That seems to...
So, that's actually my topics.
So, does anybody have any questions or any more feedback?
Although, I think we covered the burning topics already?
Yes.
So, I want to mention...
Go away from always mentioning, like the non-TPM thing,
as the fallback for that, for any sort of desktop systems,
isn't it?
Doesn't it make more sense for the PIDOS stuff to be the primary thing?
And then the TPM be the add-on to that?
Instead of making the focusing so much on the TPM,
then, like, this fall face or whatever, we're in the fall.
So, yeah, the suggestion is, like, why do the TPM is the default,
and not the passphrases is the fallback?
My logic with that is really, in the case of A on,
you know, being partly because I'm lazy.
You know, I just want my laptop to boot.
I don't want to actually enter a passphrase.
You know, ideally, I want to know that I'm booting, you know,
the boot chain that I should be.
So, I'm using FTE with TPM to really give me that verification
that my system is good.
And, yeah, I'm not interested in having a passphrase
to unlock my machine.
So, that's, you know, that's the mindset there.
Yeah, I think it's, of course, a nice thing with all of this,
because of stuff like the command line being validated,
you know, then I know no one's going in and changing,
you know, boot to bin batch and doing silly stuff like that.
So, my Linux actual login passphrase is suddenly
actually meaningful.
So, I rely on that to do my data.
So, that's, that's the mindset switch that I've done with that
and that's kind of way to reflect it with that.
I get, like, through the traditional way,
is thinking the other way around.
But, like, then if I do, then I lose all of my checking of my entire boot chain.
Like, that's, that's what I want this for.
Like, yeah.
Yeah, so, that's the logic.
Yes.
If someone still, if someone stills your laptop,
I'm relying on your, your Linux authentication
to actually work and not be easily bypass,
because you can't easily bypass it, because you can't go
and do stuff like changing the same thing.
So, yeah, totally different approach.
I get it.
I know that freaks some people out, but I'm happy with that.
But with that caveat of, like, you, yeah,
the command line checking really has to be good.
Yeah.
Any more questions?
Five more minutes.
Yeah, go, five more minutes.
Yes.
So, the suggestion is, yeah, using the camera on boot to read the QR code
from your phone for the recovery key.
I mean, I like that idea.
I don't think I'm going to get away with putting a camera driver
into a system D-boot, maybe.
Yeah.
Like, that's, that's a lot of, like, how do you show that to the user
so they know where to hold the phone?
Like, so then you need, then you need to, like,
wail in the system D-boot.
Yeah.
Cool, cool.
Doable.
Yeah.
You think with the duty of the icon packages, then we just have to pull in
the right packages from there, then we'll see.
And then we'll be blown.
Yeah.
Because I like this, like, the other, this, the person who got the cursor in the
there, means, for example, it is taking, having the user to
need, how do you talk to your user, to be, you know,
show me, so we, because I was talking to the,
the idea is that we need to put the rules of something.
That's what we need to be.
And we're heading to camera.
It's just more efficient.
I think it's just coming.
Let's go.
Yeah.
It's a little exalogy.
Have the camera check it your face.
Yeah.
Sure.
One thing I wanted to mention is that, you know,
we do the pilot thing, was it did the end stuff?
Mm-hmm.
Some of the else we can do is, like,
like a TOTC thing against the TBM.
Yeah.
So, and that, that wouldn't make the case so much shorter.
Yeah.
That would be the regular TOTB, that everybody has.
Yeah.
Somewhere on my tip, do was, more so than,
fight over to support with TBM, at the same time,
as to just TOTOTB.
TOTB with that, that would, that would be,
yeah.
I mean, when it comes to multi-factor,
I'd like to have more options than just relying on the TPM.
Yeah.
This isn't using as a really nice thing that our,
uh, cell phone operating system should be nice, absolutely.
Yeah.
By a while, the PCR, we're, like, the QR code that we currently show,
um, that's a fucking text rate.
Yeah.
It's not great.
But it's better than nothing, and, yeah.
Yeah.
Do you support having multiple factors in combination?
So five of key plus something?
No.
That's kind of what we're talking about.
Like, I'd, yeah.
Yeah.
That's interesting.
There always comes up.
People want to use, like, as I said, that's, like, the,
some is secret charity.
Um, I think that's, uh, there would be income model, actually,
then, not the five or two plus TBMs,
that, that's the, that's the problem that people are doing,
because, um, you know, if you use as a success,
and then combine this in user space, the keys,
um, that you get from the digital hardware,
and, um, there's all done in, in user space, right, like, um,
and there's no way to do it in the TBM.
Because I don't think you can.
No.
And that's, yeah.
Yeah.
So, uh, yeah, the next best thing is, like,
it's much nicer than if, for the five or two TBMs stuff,
um, there is no, yeah, all the calculations that
are done in the TBMs, and it's by the device,
and, uh, only when everything checks out,
the TBM will release the volume P to you,
and that's a really nice model.
One last comment, as soon as the timer just might be ours,
you can clear the eyes and the campaign.
Yeah.
You'll be able to do the device for the end and sign them,
only the way the PCR stuff sign as well.
That's, that's, that's, as of last week.
So that's, that's, that's, that's my, yeah,
on the back there for the network.
Perfect.
So, yeah.
So, so, even if I do, I'm stuck on doing you guys,
it's going to be easy.
That's, awesome news. Thank you.
Great.
Okay.
Uh, yes, I think we're all the time, so let's thank Richard.