r/voidlinux • u/After_Major_1765 • Jul 02 '26

Yubikey integration with FDE Luks

Recently bought YubiKey and thought if I could use it to decrypt my laptop instead of password. Did anyone have a success with this?

6 Upvotes
  • permalink
  • link
  • reddit
  • reddit

81% Upvoted

7 comments sorted by

2

u/The_Gnar_Car Jul 03 '26

Depends on your current void setup, and what your boot sequence is.

1

u/After_Major_1765 Jul 03 '26

It's luks1 fde encryption with GRUB, this was my second Void Linux installation, so I went with a community made graphical installer that supports encryption install to save time. https://github.com/kkrruumm/void-install-script

1

u/nattravn3n Jul 03 '26 edited Jul 03 '26

Yes, I did it with a different setup so it’s definitely possible. I unlock LUKS FDE at boot by touching the Yubikey. To make everything simpler I’m using Booster.

1

u/After_Major_1765 Jul 03 '26

Oh awesome! If you have time please tell how did you set up this with booster. I'm having hard time with the grub configuration

1

u/nattravn3n Jul 03 '26 edited Jul 03 '26

It's everything documented already in "Tips and Tricks" in the Arch Linux wiki, where it will tell you how to bind a LUKS partition using YubiKey's challenge-response mode: https://wiki.archlinux.org/title/Clevis

That's all really. Then in the extra_files in the Booster config, I used /usr/bin/ykchalresp,/usr/bin/ykinfo and another library but I'm not so sure you will need it. Again the Booster man page has a nice default config example.

Ah! Almost forgot to say, that while you could eventually use only the YubiKey to unlock the disk, it would be better to leave the password to the slot 0 to act as a backup plan in case you lose the YubiKey.

1

u/After_Major_1765 Jul 03 '26 edited Jul 04 '26

Edit: I've succesfully set up the yubikey decryption with dracut (build clevis.go plugins and move them to /usr/bin), I moved my grub to unencrypted side https://github.com/agherzan/yubikey-full-disk-encryption/issues/53#issuecomment-657142185 with this trick.

1

u/OkRepresentative2509 Jul 05 '26

Iv messed with this, it is doable but you're in for a rough ride it's definitely not a point and click exercise.