What is Policy-Based Decryption?
Policy-based Decryption (PBD) is a collection of technologies that enable automated unlocking of encrypted volumes of hard drives on physical and virtual machines using a variety of unlocking methods. When the unlocking method uses a special network server, we call it Network-Bound Disk Encryption (NBDE).
As you can see in many recent releases of Red Hat Enterprise Linux (RHEL), Red Hat is committed to bringing improvements to PBD and NBDE. This article attempts to introduce some of them.
Tang keys rotation
NBDE requires a special network server. In RHEL, this server is called Tang and setting up NBDE involves setting up Tang. Tang generates keys to use for data encryption and decryption. Administrators should rotate these keys periodically and also update the clients to use the new keys, to avoid data loss.
Rotating Tang keys involves generating new keys for the server and excluding the current ones from the server advertisement so that clients no longer use the former keys, but the new ones, the ones advertised. Rotated keys still exist from the perspective of the server, and clients that were bound to them still work. It is advisable to update client bindings to use the new keys, and once no clients are using the rotated keys, we can then remove them safely.
Binding update in the clients
Updating the bindings on the client-side involves comparing the keys used for binding with the ones advertised by the Tang server. If the keys used for binding are not present in the server advertisement, it means they have been rotated in the server, in which case you could update the binding to use the new keys.
Performing this kind of verification was a complex task, as one had to deal directly with several command-line interface (CLI) utilities, such as cryptsetup, jose, luksmeta -- if handling LUKS v1 devices --, and so on, to verify whether the bindings are using rotated keys.
Getting information to answer questions like "What bindings do I have in this device, if any?" or "What configuration is it using in this particular slot, as in, which Tang server is it bound to?", for instance, was already a non-trivial task.
RHEL now offers a few command-line utilities that help to answer these questions and also help to simplify the process of performing the key rotation on the clients when required.
One of the tools you'll use is clevis
, a utility to do things like bind, encrypt and decrypt devices. The clevis luks list
command that can list clevis pins bound to a particular LUKS device.
Using clevis luks list
This command indicates whether there are any bindings, and what their configuration details are. As an example, identify Clevis bindings in the/dev/sda2 device:
clevis luks list -d /dev/sda2 1: tang '{"url":"10.0.0.10"}'
The output of clevis luks list
in this example indicates slot number 1 in /dev/sda2 is bound to a Tang configuration, and the associated Tang server is 10.0.0.10. This is useful information we did not have before.
At this point, the clevis luks report
and clevis luks regen
operations help you with identifying if there are any rotated keys and performing the binding update itself.
The clevis luks report and clevis luks regen commands
These two commands simplify the rotation of keys. The former tells you whether you are using any rotated keys, and the latter performs a rebinding, which means your Tang server will be using the new keys after it finishes.
Using clevis luks report
compares the keys in use in the binding with the keys advertised by the server. If it detects the keys differ, it reports about the presence of rotated keys and offers to use clevis luks regen, to update the binding.
Using clevis luks regen
, on the other hand, performs a rebinding using the existing binding configuration. After it runs, the binding will be using the new keys, and if you re-run clevis luks report, then you will get no output, meaning that there are no rotated keys present.
For specifics on how to use these commands, please refer to the RHEL product documentation.
Edit bindings
This new option to clevis luks
helps you to edit a particular binding configuration to change specific attributes. For example, in a tang pin, you can change the URL address of the Tang server:
clevis luks edit -d /dev/sda2 -s 1
The previous command opens a text editor with the JSON configuration of the pin in slot number 1 in /dev/sda2, which we can then edit:
{ "url": "10.0.0.10" }
Once you complete the editing, you can save and quit the editor. At this point, Clevis validates the updated JSON configuration and applies it if it does not detect any errors.At the end of this step, you have updated the binding with the new configuration.
Just like their own configuration, the pins support changing different attributes: For example, the tang pin allows changing the URL of the Tang server, while the tpm2 pin allows changing properties like the hash or key, for instance. When using the sss pin, one of the attributes we could change is the threshold of Shamir’s Secret Sharing scheme; we could also either add or remove new pins to its configuration.
Conclusion
As key rotation plays a crucial part in Network-Bound Disk Encryption, RHEL has been focusing on improving the user experience around the relevant procedures involved in it. The procedures that have been traditionally complex. In this post, we presented a few command-line utilities that simplify both verifying if any keys should be updated, as well as updating them when required. Additionally, we also presented another utility that enables you to change parameters in the binding configuration in an easy way.
저자 소개
Sergio Correia is a software engineer in the Linux Security Group at Red Hat. He is part of the Special Projects team, which is focused on productization and development of security technologies such as fapolicyd, USBGuard and AIDE. He currently maintains the Policy-Based Decryption (PBD) components, which includes Clevis and Tang.
채널별 검색
오토메이션
기술, 팀, 인프라를 위한 IT 자동화 최신 동향
인공지능
고객이 어디서나 AI 워크로드를 실행할 수 있도록 지원하는 플랫폼 업데이트
오픈 하이브리드 클라우드
하이브리드 클라우드로 더욱 유연한 미래를 구축하는 방법을 알아보세요
보안
환경과 기술 전반에 걸쳐 리스크를 감소하는 방법에 대한 최신 정보
엣지 컴퓨팅
엣지에서의 운영을 단순화하는 플랫폼 업데이트
인프라
세계적으로 인정받은 기업용 Linux 플랫폼에 대한 최신 정보
애플리케이션
복잡한 애플리케이션에 대한 솔루션 더 보기
오리지널 쇼
엔터프라이즈 기술 분야의 제작자와 리더가 전하는 흥미로운 스토리
제품
- Red Hat Enterprise Linux
- Red Hat OpenShift Enterprise
- Red Hat Ansible Automation Platform
- 클라우드 서비스
- 모든 제품 보기
툴
체험, 구매 & 영업
커뮤니케이션
Red Hat 소개
Red Hat은 Linux, 클라우드, 컨테이너, 쿠버네티스 등을 포함한 글로벌 엔터프라이즈 오픈소스 솔루션 공급업체입니다. Red Hat은 코어 데이터센터에서 네트워크 엣지에 이르기까지 다양한 플랫폼과 환경에서 기업의 업무 편의성을 높여 주는 강화된 기능의 솔루션을 제공합니다.