mevdschee / bitlocker-luks-tools

Bitlocker and LUKS tools

The power of full disk encryption lies in that it is easy to understand and reason about. A key file on a USB drive is such a simple solution for which you can find tools and instructions in this repository.

create_usb.sh

This bash script ERASES everything on a USB drive and:

• Creates a GUID partition table (GPT).
• Adds a single EFI Startup Partition (ESP) on it.
• Formats the ESP in FAT16 format.
• Copies the ".BEK" files from the "keys" folder (and subfolders) to the drive.
• Copies the ".lek" files from the "keys" folder (and subfolders) to the drive.

Demo:

Windows 10 Pro - Bitlocker

On Windows the Trusted Platform Module (TPM) will hold your disk encryption keys and bind your disk to your motherboard. This TPM might get wiped on BIOS updates (especially on AMD where the TPM is virtual). You can avoid all this trouble this by disabling TPM in your computer's BIOS. If you do this then your disk is encrypted by the key file or passphrase (as expected).

Read more: https://tqdev.com/2021-why-i-use-bitlocker-without-tpm

Configure Bitlocker without TPM

To configure Bitlocker without TPM, follow these steps:

• Disable TPM in your BIOS (very important!)
• Open the Local Group Policy Editor by pressing Windows+R.
• Type "gpedit.msc" into the Run dialog box, and press Enter.
• Navigate to Local Computer Policy > Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives in the left pane.
• Double-click the "Require additional authentication at startup" option in the right pane.
• Select "Enabled" at the top of the window, and ensure the "Allow BitLocker without a compatible TPM (requires a password or a startup key on a USB flash drive)" checkbox is enabled here.
• Click "OK" to save your changes.
• You can now close the Group Policy Editor window.
• Enable BitLocker and choose to use a startup key on a USB flash drive (BEK file).

source: https://www.howtogeek.com/howto/6229/how-to-use-bitlocker-on-drives-without-tpm/

Ubuntu 22.04 - LUKS

On Linux the TPM is not used. The key file or passphrase is enough to decrypt the drive (as expected).

Configure LUKS

During the installation of Ubuntu you can choose to use LVM and encrypt the entire disk. During the installation you need to choose a passphrase.

generate_key.sh

This bash script creates keys for a LUKS enabled machine.

• It generates a new UUID based key file.
• It generates a new recovery key (passphrase).
• It creates a bash script to install the LUKS keys.

After installing and testing the newly added keys you may remove the initial passphrase (entered during installation) from slot 0.

Debugging (for development)

If your script in /bin/luksunlockusb contains an error you need to adjust it. To do this boot a Live CD and read-write mount the unencrypted boot partition. Copy the initrd.img file to you Live CD Desktop folder and open a Terminal there.

Then, expand current initramfs.

mkdir initrd
cd initrd
gzip -dc ../initrd.img | cpio -i

And then, change as you like (especially /bin/luksunlockusb). After finishing your change, compress it to generate new initramfs using:

find . | cpio -H newc -o | gzip -9 > ../initrd.img

Now you have the new initrd.img file that you want to write back to you boot partition (overwrite the existing one).

See also: https://tqdev.com/2023-luks-recovery-from-initramfs-shell

bitlocker-luks-tools's Issues

Sharing usb key with more content

In your guide, you mention:

Technically it may contain any other content and may be followed by one or more partitions of any type. I prefer to leave them with only this single hidden partition as it prevents (non-technical) people from using the USB stick as a drive (I use key shaped USB drives). You can find some of my scripts on my GitHub

What is the problem you have found of having several other partitions available in such disk for content?

Ubuntu 22.04 issues

Hello, unfortunately I seem to have run into some troubles with Ubuntu 22.04. After using your scripts, Everything seems to set up fine but at the luks prompt It dosent seem to find/accept the key file on the usb.

I then tried following your step by step instructions https://tqdev.com/2022-luks-with-usb-unlock. At the luks screen it just loops continuously saying I've tried to many times unsuccessfully.

Is there and issue with 22.04 that you might be aware of? Could it be a hardware problem?

Thanks

Debian 11: `mount` fails with error "device does not exist."

@Rodgers13 I had this issue too, on Debian 11. mount was failing for the partition containing the key file, with an error message of "device does not exist."

I found this unlock-root.sh script. Instead of adding a filesystem and mounting it on boot, the keyfile is written directly to the first partition. The script just uses dd to read in the raw disk content.

Also, a big thank you to mevdschee for this repo and the very well-written blog post, I found it to be very helpful 🥇

---

# find your USB stick in /dev/disk/by-id/usb-*
export $KEY=/dev/disk/by-id/usb-THE-DEVICE-YOU-WANT-TO-USE-part1

# write the keyfile contents to the first partition
dd if=keyfile-you-created.lek of=$KEY bs=1 count=256

# use the script above, fill out $KEY and set $LEN=256

Originally posted by @mheppner in #1 (comment)