WiP: Generate diceware passphrases in oem-factory-reset, output qr code of configured secrets prior of reboot#1850

Draft

tlaurion wants to merge 25 commits intolinuxboot:masterfrom tlaurion:generate_passphrase-reownership_qr_code

+2,849-1,134

Commits on Dec 5, 2024

diceware: add short list v2, requiring 4 dices and providing longer words then short list v1 for easier to remember passphrases
tlaurion
committed
initrd/etc/functions: add generate_passphrase logic
tlaurion
committed
WiP initrd/bin/oem-factory-reset: format unification
tlaurion
committed
WiP initrd/bin/oem-factory-reset: add --mode (oem/user) skeleton
tlaurion
committed
/etc/functions:: reuse detect_boot_device instead of trying only to mount /etc/fstab existing /boot partition (otherwise early 'o' to enter oem mode of oem-factory-reset
tlaurion
committed
WiP initrd/bin/oem-factory-reset: add qrcode+secet output loop until user press y (end of reownership wizard secret output)
tlaurion
committed
WiP: bump to hotp-verification version supporting reset of secret app
tlaurion
committed
WiP: add nk3 secret app reset function and call it following security dongle reset logic
tlaurion
committed
modules/hotp-verification: revert to 1.6, add patches tested instead
tlaurion
committed
oem-factory-reset: add reset secure app PIN = ADMIN_PIN at reownership, make sure defaults are set for all modes, including default which uses current defaults being DEF pins (12345678 and 123456 a…
tlaurion
committed
modules/hotp-verification: 1.6, removing patch pr43, only keeping 46 for this PR (43 conflicts when applied atop 46. 46 is needed here)
tlaurion
committed
oem-factory-reset: don't set user re-ownership by default for now: use current defaults being DEF pins (12345678 and 123456 as master)
tlaurion
committed
oem-factory-reset: if nk3, also display Secure App PIN = GPG Admin PIN as text and in Qr code
tlaurion
committed
oem-factory-reset: fix Secure App wording, prevent word globbing, warn that physical presence is needed
tlaurion
committed
oem-factory-reset: set title_text accordingly to mode, either 'OEM Factory Reset Mode', 'Re-Ownership Mode' or 'OEM Factory Reset / Re-Ownership'
tlaurion
committed
oem-factory-reset: reset nk3 secure app PIN early since we need physical presence, put nk3 secure APP PIN after TPM but before GPG PINS in output for consistency
tlaurion
committed
kexec-sign-config: mount rw, write things to /boot, mount ro after
tlaurion
committed
WiP seal-hotp: customize message to be GPG Admin PIN or Secure App PIN
tlaurion
committed

Commits on Dec 6, 2024

Commits on Dec 7, 2024

patches/hotp-verification-*/46.patch : readd Nitrokey/nitrokey-hotp-verification#46 so that this PR can be tested and reviewed from OEM Factory Reset/User Re-Ownership perspective
tlaurion
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

WiP: Generate diceware passphrases in oem-factory-reset, output qr code of configured secrets prior of reboot#1850

Commits on Dec 5, 2024

diceware: add short list v2, requiring 4 dices and providing longer words then short list v1 for easier to remember passphrases

initrd/etc/functions: add generate_passphrase logic

WiP initrd/bin/oem-factory-reset: format unification

WiP initrd/bin/oem-factory-reset: add --mode (oem/user) skeleton

/etc/functions:: reuse detect_boot_device instead of trying only to mount /etc/fstab existing /boot partition (otherwise early 'o' to enter oem mode of oem-factory-reset

WiP initrd/bin/oem-factory-reset: add qrcode+secet output loop until user press y (end of reownership wizard secret output)

WiP: bump to hotp-verification version supporting reset of secret app

WiP: add nk3 secret app reset function and call it following security dongle reset logic

modules/hotp-verification: revert to 1.6, add patches tested instead

oem-factory-reset: add reset secure app PIN = ADMIN_PIN at reownership, make sure defaults are set for all modes, including default which uses current defaults being DEF pins (12345678 and 123456 a…

modules/hotp-verification: 1.6, removing patch pr43, only keeping 46 for this PR (43 conflicts when applied atop 46. 46 is needed here)

oem-factory-reset: don't set user re-ownership by default for now: use current defaults being DEF pins (12345678 and 123456 as master)

oem-factory-reset: if nk3, also display Secure App PIN = GPG Admin PIN as text and in Qr code

oem-factory-reset: fix Secure App wording, prevent word globbing, warn that physical presence is needed

oem-factory-reset: set title_text accordingly to mode, either 'OEM Factory Reset Mode', 'Re-Ownership Mode' or 'OEM Factory Reset / Re-Ownership'

oem-factory-reset: reset nk3 secure app PIN early since we need physical presence, put nk3 secure APP PIN after TPM but before GPG PINS in output for consistency

kexec-sign-config: mount rw, write things to /boot, mount ro after

WiP seal-hotp: customize message to be GPG Admin PIN or Secure App PIN

Commits on Dec 6, 2024

hotp-verification patches: Use Nitrokey/nitrokey-hotp-verification#43 instead of Nitrokey/nitrokey-hotp-verification#46 for hotp-verification info parsing and validation of oem-factory-reset and se…

oem-factory-reset+seal-hotp nk3 hotp-verification info adaptations

hotp-verification: removed patches/hotp-verification-e9050e0c914e7a8ffef5d1c82a014e0e2bf79346 directory: waiting for Nitrokey/nitrokey-hotp-verification#43 and Nitrokey/nitrokey-hotp-verification#46 …

functions: Fix spelling of 'dictionaries'

functions: Simplify dictionary word selection

oem-factory-reset: Stop adding leading blank lines in 'passphrases' msg

Commits on Dec 7, 2024

patches/hotp-verification-*/46.patch : readd Nitrokey/nitrokey-hotp-verification#46 so that this PR can be tested and reviewed from OEM Factory Reset/User Re-Ownership perspective