Anaconda/Features/Encrypted Boot IPA key Management

From FedoraProject

Jump to: navigation, search

Contents

Anaconda Encrypted Boot IPA key Management

Summary

Provide enterprise-class key management support for encrypted devices

Owner

Current status

Detailed Description

Add support for saving encryption keys (to recover access to a volume when the passphrase is forgotten, or when the user leaves a company), and for creating backup passphrases (to be disclosed to the user when the user forgets the passphrase and is on the road). See Key Management for general discussion, Disk encryption key escrow use cases for specifics.

Subtasks:

Target Audience

Enterprise customers want a means by which they can guarantee access to the data on encrypted block devices in employees' systems. This way they still have a way in if the user changes the device's keys/passphrases.

Product Variants / High Level Use Cases

Relevant to desktops/laptops particularly, but depending upon implementation may be interesting for other products as well e.g. to support encrypted databases, medical records protection.

Hardware Architectures

All

Testing

TBD but should be integrated with anaconda storage testing

Third-Party Dependencies

Cryptsetup-luks, volume_key, perhaps python-nss, and anaconda interdependencies

Bugzilla Numbers

Note: The above description does not address the "admin keyslot" requirement. This remains an useful feature, does anybody own it?
Retrieved from "https://fedoraproject.org/wiki/Anaconda/Features/Encrypted_Boot_IPA_key_Management"