Arch Linux

analbeard

Member

From: London

Registered: 2014-11-07

Posts: 49

LUKS+yubikey sometimes fails to unlock

Bear with me a little as this is an odd one. I normally have my laptop permanently connected to an external keyboard and I have zero problems unlocking my encrypted partition on boot (using the ykfde hook) there. But when I occasionally use my laptop out and about I am never able to unlock the partition on the first go - when I tried it just now it took 5 attempts because I kept getting the 'no key exists with this passphrase' message. I know I'm typing the passphrase correctly because I was being very deliberate about it because I expected this to happen. I even typed it in before plugging in the yubikey so it was printed to the commandline - there were no weird characters, just the correct passphrase. This issue only ever happens when using the laptop keyboard .

Has anyone ever experienced this before, or am I just going mad?

Ammako

Member

Registered: 2021-07-16

Posts: 267

Re: LUKS+yubikey sometimes fails to unlock

I don't use yubikey, but I've started getting this lately despite that I'm most definitely entering the correct passphrase. Sometimes takes 1-2 times before it finally accepts it.

In fact, just now, I very deliberately slowly typed each character to make sure I wasn't making any mistakes, and it still complained that no key existed with this passphrase.

It only started happening in recent weeks, so it might be something got an update that was a bit screwy, but I'm not bothered enough to try and look closer to be honest. But it's not just you.

Not on a laptop or anything, just my regular old desktop with the same keyboard I've been using for over a year.

analbeard

Member

From: London

Registered: 2014-11-07

Posts: 49

Re: LUKS+yubikey sometimes fails to unlock

I'm glad to hear I'm not the only one seeing some sort of weirdness with unlocking my FDE. The `ykfde` hook has an option to enable debugging which prints everything to the terminal - I think I'm going to enable that and see if I can reproduce it. Annoyingly it doesn't seem to be happening at the moment - typical.

TJM

Member

Registered: 2016-09-18

Posts: 118

Re: LUKS+yubikey sometimes fails to unlock

This should not happen if you employ yubikey or other gpg smart cards which encrypt the key file to decrypt your LUKS-protected partition. What I suggest is that you could add a hook in your initramfs where the checksum of the decrypted key file will get printed. So you could check if the key file has been correctly decrypted, or something else happened.

P.S. Given the latest documentary by Derek Muller from his youtube channel veritasium, this might be the result of bit flips caused by radioactive particles stimulated by cosmic radiation. Glad to hear that there are better protection from radioactive particles at your place

Last edited by TJM (2021-09-01 12:48:18)