diff --git a/tzpfms.pdf b/tzpfms.pdf index 5e62976..cf1ac9a 100644 Binary files a/tzpfms.pdf and b/tzpfms.pdf differ diff --git a/tzpfms.ps b/tzpfms.ps index a9f0e90..05918ec 100644 --- a/tzpfms.ps +++ b/tzpfms.ps @@ -1,15 +1,15 @@ %!PS-Adobe-3.0 %%Creator: groff version 1.23.0 -%%CreationDate: Fri Mar 29 11:45:22 2024 +%%CreationDate: Fri Mar 29 11:47:34 2024 %%DocumentNeededResources: font Times-Roman %%+ font Times-Bold %%+ font Courier-Bold %%+ font Courier-Oblique %%+ font Courier -%%+ font Times-Italic %%+ font Symbol +%%+ font Times-Italic %%DocumentSuppliedResources: procset grops 1.23 0 -%%Pages: 15 +%%Pages: 10 %%PageOrder: Ascend %%DocumentMedia: Default 595 842 0 () () %%Orientation: Portrait @@ -237,8 +237,8 @@ setpacking %%IncludeResource: font Courier-Bold %%IncludeResource: font Courier-Oblique %%IncludeResource: font Courier -%%IncludeResource: font Times-Italic %%IncludeResource: font Symbol +%%IncludeResource: font Times-Italic grops begin/DEFS 1 dict def DEFS begin/u{.001 mul}bind def end/RES 72 def/PL 841.89 def/LS false def/ENC0[/asciicircum/asciitilde/Scaron /Zcaron/scaron/zcaron/Ydieresis/trademark/quotesingle/Euro/.notdef @@ -276,398 +276,15 @@ def/PL 841.89 def/LS false def/ENC0[/asciicircum/asciitilde/Scaron %%BeginPageSetup BP %%EndPageSetup -/F0 10/Times-Roman@0 SF(ZFS-FIDO2-ADD-B)72 48 Q -.4(AC)-.35 G 42.103 -(KUP\(8\) System).4 F(Manager')2.5 E 2.5(sM)-.55 G 39.602 -(anual ZFS-FIDO2-ADD-B)-2.5 F -.4(AC)-.35 G(KUP\(8\)).4 E/F1 10 -/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF -(zfs-fido2-add-backup)108 96 Q F0 2.5<8a61>2.5 G(llo)-2.5 E 2.5(wa)-.25 -G(nother FIDO2 de)-2.5 E(vice to unlock ZFS dataset)-.25 E F1(SYNOPSIS) -72 112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q/F3 10/Courier-Oblique@0 -SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0(After)108 153.6 Q/F4 10 -/Courier@0 SF(zfs-fido2-change-key)7.564 E F0 5.064(\(8\) deri)B -.15 -(ve)-.25 G 7.563(st).15 G 5.063(he k)-7.563 F 5.363 -.15(ey f)-.1 H -5.063(or a dataset from a FIDO2 de).15 F(vice,)-.25 E F2 -(zfs-fido2-add-backup)108 165.6 Q F0(may be e)2.5 E -.15(xe)-.15 G -(cuted to e).15 E(xtend this to an)-.15 E 2.5(yn)-.15 G -(umber of additional de)-2.5 E(vices.)-.25 E .273(First, the wrapping k) -108 182.4 R .574 -.15(ey i)-.1 H 2.774(se).15 G .274 -(xtracted as normally during)-2.924 F F4(zfs-fido2-load-key)2.774 E F0 -.274(\(8\), then a credential)B 1.604(is made as-if during)108 194.4 R -F4(zfs-fido2-change-key)4.104 E F0 1.604(\(8\) \(e)B 1.604 -(xcept the "primary" de)-.15 F 1.603(vice and all the ones)-.25 F .185 -(holding backups are e)108 206.4 R .185(xcluded from the search\); ho) --.15 F(we)-.25 E -.15(ve)-.25 G .985 -.4(r, t).15 H(he).4 E F4 -(hmac-secret)2.685 E F0 .185(is instead used as a sym-)2.685 F 1.555 -(metric AES-256-GCM \()108 218.4 R F4(EVP_CIPHER-AES)A F0 1.555 -(\(7ssl\)\) k)B 1.855 -.15(ey t)-.1 H 4.055(oe).15 G 1.555 -(ncrypt the wrapping k)-4.055 F 1.855 -.15(ey d)-.1 H 1.555 -(irectly with a).15 F(random IV)108 230.4 Q(.)-1.29 E 1.403 -(This turns the)108 247.2 R F4(xyz.nabijaczleweli:tzpfms.key)3.903 E F0 --.25(va)3.903 G 1.404(riable into a dot-separated list of de).25 F(vice) --.25 E -.2(bu)108 259.2 S(ndles:).2 E F3(salt)118 271.2 Q F2(:)A F3 -(credential-ID)A F2(:)A F3(credential-public-key)A F0([)A F2(.)A F3 -(backup-salt)A F2(:)A F3(backup-credential-ID)118 283.2 Q F2(:)A F3 -(backup-credential-public-key)A F2(:)A F3(IV)A F2(:)A F3(encrypted-key) -118 295.2 Q F0 1.666(]...)C .155(The \214rst one is as-described in)108 -307.2 R F4(zfs-fido2-change-key)2.655 E F0 2.655(\(8\). Subsequent)B -.155(ones also include \(identi-)2.655 F -(cally-encoded\) IVs and encrypted blobs.)108 319.2 Q F4 -(zfs-fido2-load-key)108 336 Q F0 .081(\(8\) shops assertions around de)B -.081(vices in a de)-.25 F .082(vice-major order \212 depending on)-.25 F -(de)108 348 Q(vice numbering, a backup may be loaded e)-.25 E -.15(ve) --.25 G 2.5(ni).15 G 2.5(ft)-2.5 G(he primary de)-2.5 E(vice is present.) --.25 E F1(ENVIR)72 364.8 Q 1.666(ONMENT V)-.3 F(ARIABLES)-1.35 E F4 -(TZPFMS_PASSPHRASE_HELPER)108 376.8 Q F0 .046(By def)133 388.8 R .045(a\ -ult, passphrases are prompted for and read in on the standard output an\ -d input streams.)-.1 F(If)5.045 E F4(TZPFMS_PASSPHRASE_HELPER)133 400.8 -Q F0 1.595(is set and nonempty)4.095 F 4.096(,i)-.65 G 4.096(tw)-4.096 G -1.596(ill be run via)-4.096 F F4(/bin/)4.096 E F2 3.262(sh \255c)B F0 -(to)4.096 E(pro)133 412.8 Q(vide each passphrase, instead.)-.15 E .643 -(The standard output stream of the helper is tied to an anon)133 429.6 R -.643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) -133 441.6 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F4($1)143 453.6 Q F0 -(Pre-formatted noun phrase with all the information belo)160 453.6 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E F4($2)143 465.6 Q F0 -(Either the dataset name or the de)160 465.6 Q -(vice feature being prompted for)-.25 E F4($3)143 477.6 Q F0("ne)160 -477.6 Q(w" if this is for a ne)-.25 E 2.5(wp)-.25 G -(assphrase, otherwise blank)-2.5 E F4($4)143 489.6 Q F0("ag)160 489.6 Q -(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .177 -(If the helper doesn')133 506.4 R 2.677(te)-.18 G .177 -(xist \(the shell e)-2.827 F .177(xits with)-.15 F F1(127)2.677 E F0 -.178(\), a diagnostic is issued and the normal prompt)B(is used as f)133 -518.4 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 -G(ther reason, the prompting is aborted.)-2.5 E F1 1.666 -(FIDO2 back-end con\214guration)72 535.2 R(En)87 547.2 Q(vir)-.4 E .625 -(onment v)-.18 F(ariables)-.1 E F4(FIDO_DEBUG)108 559.2 Q F0 -(If set, enables lib\214do2 deb)173 559.2 Q -(ug logging to the standard error stream.)-.2 E F1(De)87 576 Q .625 -(vice selection)-.15 F F0 .727(When creating, the \214rst de)108 588 R -.727(vice which supports the)-.25 F F4(hmac-secret)3.226 E F0 -.15(ex) -3.226 G .726(tension is used.).15 F .726(When loading,)5.726 F -(the assertion yielding the k)108 600 Q .3 -.15(ey i)-.1 H 2.5(ss).15 G -(hopped around to e)-2.5 E -.15(ve)-.25 G(ry such de).15 E(vice.)-.25 E -F1 .625(See also)87 616.8 R F0 -(The lib\214do2 documentation at https://de)108 628.8 Q -.15(ve)-.25 G -(lopers.yubico.com/lib\214do2/.).15 E F1 1.666(SPECIAL THANKS)72 645.6 R -F0 1.6 -.8(To a)108 657.6 T(ll who support further de).8 E -.15(ve)-.25 -G(lopment, in particular:).15 E F1<83>128 669.6 Q F0(ThePhD)7.5 E F1<83> -128 681.6 Q F0(Embark Studios)7.5 E F1<83>128 693.6 Q F0(Jasper Bekk)7.5 -E(ers)-.1 E F1<83>128 705.6 Q F0(EvModder)7.5 E F1(REPOR)72 722.4 Q -1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 734.4 Q -(.ht/\001nabijaczle)-.55 E(weli/fzifdso)-.25 E F4 -(\001nabijaczleweli/tzpfms@lists.sr.ht)108 751.2 Q F0 83.762(,a)C(rchi) --83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E(https://lists.sr) -108 763.2 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E(fzifdso 0.4.0) -72 817.889 Q(March 11, 2024)143.568 E(1)188.837 E 0 Cg EP -%%Page: 1 2 -%%BeginPageSetup -BP -%%EndPageSetup -/F0 10/Times-Roman@0 SF 41.363(ZFS-FIDO2-CHANGE-KEY\(8\) System)72 48 R -(Manager')2.5 E 2.5(sM)-.55 G 38.862(anual ZFS-FIDO2-CHANGE-KEY\(8\)) --2.5 F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 -SF(zfs-fido2-change-key)108 96 Q F0 2.5<8a63>2.5 G(hange ZFS dataset k) --2.5 E .3 -.15(ey t)-.1 H 2.5(oo).15 G(ne authenticated by a FIDO2 de) --2.5 E(vice)-.25 E F1(SYNOPSIS)72 112.8 Q F2(zfs-fido2-add-backup)108 -124.8 Q F0([)2.5 E F21.666 E/F3 10/Courier-Oblique@0 SF -(backup-file)6 E F0(])A F3(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 -2.867 -.8(To n)108 153.6 T 1.267(ormalise the).8 F F3(dataset)3.767 E F0 -(,)A F2(zfs-fido2-add-backup)3.766 E F0 1.266 -(will open its encryption root in its stead.)3.766 F F2 -(zfs-fido2-add-backup)108 165.6 Q F0(will)14.654 E/F4 10/Times-Italic@0 -SF(ne)14.654 E(ver)-.15 E F0 12.154(create or destro)14.654 F 14.655(ye) --.1 G 12.155(ncryption roots; use)-14.655 F/F5 10/Courier@0 SF -(zfs-change-key)108 177.6 Q F0(\(8\) for that.)A -(First, a connection is made to the FIDO2 de)108 194.4 Q(vice, which) --.25 E F4(must)2.5 E F0(support the)2.5 E F5(hmac-secret)2.5 E F0 -.15 -(ex)2.5 G(tension.).15 E(If)108 211.2 Q F3(dataset)3.555 E F0 -.1(wa) -3.555 G 3.555(sp).1 G(re)-3.555 E 1.054(viously encrypted with)-.25 F F2 -(fzifdso)3.554 E F0 1.054(and the)3.554 F F1(FIDO2)3.554 E F0 1.054 -(back-end w)3.554 F 1.054(as used, pre)-.1 F(vious)-.25 E 1.272 -(credentials will be deleted from their de)108 223.2 R 1.272 -(vices \(as-if via)-.25 F F5(zfs-fido2-clear-key)3.773 E F0 1.273 -(\(8\)\), if a)B -.25(va)-.2 G(ilable.).25 E .594 -(Otherwise, or in case of an error)108 235.2 R 3.093(,d)-.4 G .593 -(ata required for manual interv)-3.093 F .593 -(ention will be written to the standard)-.15 F(error stream.)108 247.2 Q -(Ne)108 264 Q .464(xt, a ne)-.15 F 2.964(wc)-.25 G .464 -(redential of type ES256 is generated on the de)-2.964 F .465 -(vice \(with relying party ID)-.25 F F5(fzifdso)2.965 E F0(and)2.965 E -.499(name equal to the dataset name\) with the)108 276 R F5(hmac-secret) -2.999 E F0 -.15(ex)2.999 G .499(tension requested; the de).15 F .499 -(vice PIN, if an)-.25 F -.65(y,)-.15 G(is prompted for here.)108 288 Q -(This mimicks a W)5 E(ebAuthn re)-.8 E(gistration step.)-.15 E .962(The\ -n, the credential is asserted with a 32-byte random salt, which hashes \ -it with de)108 304.8 R(vice-pri)-.25 E -.25(va)-.25 G .963(te data,).25 -F .138(and thus generates the wrapping k)108 316.8 R .438 -.15(ey \()-.1 -H .138(which is optionally back).15 F .138(ed up \(see)-.1 F F1(OPTIONS) -2.637 E F0 2.637(\)\). This)B .137(mimicks a)2.637 F -.8(We)108 328.8 S -(bAuthn login step.).8 E(The follo)108 345.6 Q -(wing properties are set on)-.25 E F3(dataset)2.5 E F0(:)A F1<83>128 -357.6 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1(FIDO2)A<83> -128 369.6 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A F3(salt)A F2 -(:)A F3(credential-ID)A F2(:)A F3(credential-public-key)139 381.6 Q F0 -([)A F2(.)A F0 1.666(...)1.666 G 1.666(]...)-1.666 G F5(tzpfms.backend) -108 398.4 Q F0 2.707(identi\214es this dataset for w)5.207 F 2.708 -(ork with)-.1 F F1(FIDO2)5.208 E F0(-back-ended)A F2(tzpfms)5.208 E F0 -2.708(tools \(i.e.)5.208 F F2(fzifdso)108 410.4 Q F5 -(zfs-fido2-change-key)60.228 E F0(\(8\),)A F5(zfs-fido2-load-key)56.727 -E F0(\(8\),)A F5(zfs-fido2-add-backup)108 422.4 Q F0(\(8\), and)A F5 -(zfs-fido2-clear-key)2.5 E F0(\(8\)\).)A F5(tzpfms.key)108 439.2 Q F0 -.486(is a colon-separated tuple of unpadded URL-safe base64 blobs; the \ -\214rst one is the ran-)2.985 F .217(dom salt; the second represents th\ -e ID of created credential, and the third \211 its public k)108 451.2 R --.15(ey)-.1 G 5.217(.T)-.5 G .216(here e)-5.217 F(xists)-.15 E -(no other user)108 463.2 Q -(-land tool for deciphering this; perhaps there should be.)-.2 E -(Finally)108 480 Q 12.005(,t)-.65 G 9.505(he equi)-12.005 F -.25(va)-.25 -G 9.505(lent of).25 F F2 9.505(zfs change-key)12.005 F17.172 E F5 -(keylocation=prompt)15.506 E F217.172 E F5(keyformat=raw)108 492 Q -F3(dataset)6.107 E F0 .107(is performed with the ne)2.607 F 2.606(wk) --.25 G -.15(ey)-2.706 G 5.106(.I)-.5 G 2.606(fa)-5.106 G 2.606(ne)-2.606 -G .106(rror occurred, best ef)-2.606 F .106(fort is made)-.25 F -(to clean up the properties, or to issue a note for manual interv)108 -504 Q(ention into the standard error stream.)-.15 E 4.055<418c>108 520.8 -S 1.555(nal v)-4.055 F 1.556(eri\214cation should be made by running) --.15 F F2 3.222(zfs-fido2-load-key \255n)4.056 F F3(dataset)7.556 E F0 -6.556(.I)C 4.056(ft)-6.556 G(hat)-4.056 E .729 -(command succeeds, all is well, b)108 532.8 R .729 -(ut otherwise the dataset can be manually rolled back to a passphrase) --.2 F(with)108 544.8 Q F2(zfs-fido2-clear-key)5.146 E F3(dataset)8.646 E -F0(\(or)5.146 E 5.146(,i)-.4 G 5.146(ft)-5.146 G 2.646(hat f)-5.146 F -2.646(ails to w)-.1 F(ork,)-.1 E F2 2.647(zfs change-key)5.147 F -10.313 E F5(keyformat=passphrase)108 556.8 Q F3(dataset)6 E F0 -(\), and you are hereby ask)A(ed to report a b)-.1 E(ug, please.)-.2 E -F2(zfs-fido2-clear-key)108 573.6 Q F3(dataset)7.607 E F0 1.607 -(can be used to clear the properties and go back to using a)4.107 F -(passphrase.)108 585.6 Q F1(OPTIONS)72 602.4 Q F2109.666 614.4 Q -F3(backup-file)6 E F0(Sa)203 614.4 Q .352 -.15(ve a b)-.2 H .052 -(ack-up of the k).15 F .352 -.15(ey t)-.1 H(o).15 E F3(backup-file)2.552 -E F0 2.552(,w)C .052(hich must not e)-2.552 F .053(xist beforehand.)-.15 -F .694(This back-up)203 626.4 R F4(must)3.194 E F0 .694 -(be stored securely)3.194 F 3.194(,o)-.65 G -.25(ff)-3.194 G 3.194 -(-site. In).25 F .693(case of a catastrophic e)3.194 F -.15(ve)-.25 G -(nt,).15 E(the k)203 638.4 Q .3 -.15(ey c)-.1 H(an be loaded by running) -.15 E F2(zfs load-key)233 650.4 Q F3(dataset)6 E F5(<)6 E F3 -(backup-file)6 E F1(ENVIR)72 667.2 Q 1.666(ONMENT V)-.3 F(ARIABLES)-1.35 -E F5(TZPFMS_PASSPHRASE_HELPER)108 679.2 Q F0 .045(By def)133 691.2 R -.045(ault, passphrases are prompted for and read in on the standard out\ -put and input streams.)-.1 F(If)5.046 E F5(TZPFMS_PASSPHRASE_HELPER)133 -703.2 Q F0 1.596(is set and nonempty)4.096 F 4.096(,i)-.65 G 4.096(tw) --4.096 G 1.596(ill be run via)-4.096 F F5(/bin/)4.095 E F2 3.261 -(sh \255c)B F0(to)4.095 E(pro)133 715.2 Q -(vide each passphrase, instead.)-.15 E .643 -(The standard output stream of the helper is tied to an anon)133 732 R -.643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) -133 744 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E(fzifdso 0.4.0)72 817.889 Q -(March 4, 2024)146.068 E(1)191.337 E 0 Cg EP -%%Page: 2 3 -%%BeginPageSetup -BP -%%EndPageSetup -/F0 10/Times-Roman@0 SF 41.363(ZFS-FIDO2-CHANGE-KEY\(8\) System)72 48 R -(Manager')2.5 E 2.5(sM)-.55 G 38.862(anual ZFS-FIDO2-CHANGE-KEY\(8\)) --2.5 F/F1 10/Courier@0 SF($1)143 84 Q F0 -(Pre-formatted noun phrase with all the information belo)160 84 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E F1($2)143 96 Q F0 -(Either the dataset name or the de)160 96 Q -(vice feature being prompted for)-.25 E F1($3)143 108 Q F0("ne)160 108 Q -(w" if this is for a ne)-.25 E 2.5(wp)-.25 G(assphrase, otherwise blank) --2.5 E F1($4)143 120 Q F0("ag)160 120 Q(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .178 -(If the helper doesn')133 136.8 R 2.678(te)-.18 G .178 -(xist \(the shell e)-2.828 F .177(xits with)-.15 F/F2 10/Times-Bold@0 SF -(127)2.677 E F0 .177(\), a diagnostic is issued and the normal prompt)B -(is used as f)133 148.8 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an) --.1 E 2.5(yo)-.15 G(ther reason, the prompting is aborted.)-2.5 E F2 -1.666(FIDO2 back-end con\214guration)72 165.6 R(En)87 177.6 Q(vir)-.4 E -.625(onment v)-.18 F(ariables)-.1 E F1(FIDO_DEBUG)108 189.6 Q F0 -(If set, enables lib\214do2 deb)173 189.6 Q -(ug logging to the standard error stream.)-.2 E F2(De)87 206.4 Q .625 -(vice selection)-.15 F F0 .726(When creating, the \214rst de)108 218.4 R -.726(vice which supports the)-.25 F F1(hmac-secret)3.227 E F0 -.15(ex) -3.227 G .727(tension is used.).15 F .727(When loading,)5.727 F -(the assertion yielding the k)108 230.4 Q .3 -.15(ey i)-.1 H 2.5(ss).15 -G(hopped around to e)-2.5 E -.15(ve)-.25 G(ry such de).15 E(vice.)-.25 E -F2 .625(See also)87 247.2 R F0 -(The lib\214do2 documentation at https://de)108 259.2 Q -.15(ve)-.25 G -(lopers.yubico.com/lib\214do2/.).15 E F2 1.666(SPECIAL THANKS)72 276 R -F0 1.6 -.8(To a)108 288 T(ll who support further de).8 E -.15(ve)-.25 G -(lopment, in particular:).15 E F2<83>128 300 Q F0(ThePhD)7.5 E F2<83>128 -312 Q F0(Embark Studios)7.5 E F2<83>128 324 Q F0(Jasper Bekk)7.5 E(ers) --.1 E F2<83>128 336 Q F0(EvModder)7.5 E F2(REPOR)72 352.8 Q 1.666 -(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 364.8 Q -(.ht/\001nabijaczle)-.55 E(weli/fzifdso)-.25 E F1 -(\001nabijaczleweli/tzpfms@lists.sr.ht)108 381.6 Q F0 83.763(,a)C(rchi) --83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E(https://lists.sr) -108 393.6 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E(fzifdso 0.4.0) -72 817.889 Q(March 4, 2024)146.068 E(2)191.337 E 0 Cg EP -%%Page: 1 4 -%%BeginPageSetup -BP -%%EndPageSetup -/F0 10/Times-Roman@0 SF 50.243(ZFS-FIDO2-CLEAR-KEY\(8\) System)72 48 R -(Manager')2.5 E 2.5(sM)-.55 G 47.742(anual ZFS-FIDO2-CLEAR-KEY\(8\))-2.5 -F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF -(zfs-fido2-clear-key)108 96 Q F0 3.587<8a72>3.587 G -.25(ew)-3.587 G -1.087(rap ZFS dataset k).25 F 1.387 -.15(ey i)-.1 H 3.587(np).15 G -(asssw)-3.587 E 1.087(ord and clear tzpfms FIDO2 meta-)-.1 F(data)108 -108 Q F1(SYNOPSIS)72 124.8 Q F2(zfs-fido2-add-backup)108 136.8 Q/F3 10 -/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0 -(After v)108 165.6 Q(erifying)-.15 E F3(dataset)2.5 E F0 -.1(wa)2.5 G -2.5(se).1 G(ncrypted with the)-2.5 E F2(tzpfms)2.5 E F1(FIDO2)2.5 E F0 -(back)2.5 E(end:)-.1 E 5(1. performs)118 177.6 R 5.642(the equi)8.142 F --.25(va)-.25 G 5.642(lent of).25 F F2 5.642(zfs change-key)8.142 F -13.307 E/F4 10/Courier@0 SF(keylocation=prompt)11.641 E F213.307 E -F4(keyformat=passphrase)133 189.6 Q F3(dataset)6 E F0(,)A 5(2. loads)118 -201.6 R .79(the primary and e)3.29 F -.15(ve)-.25 G .79 -(ry backup credential, and for each success, if the de).15 F .791 -(vice containing it)-.25 F(supports the)133 213.6 Q F4(credMgmt)2.5 E F0 -(feature and has a PIN set, tries to delete the credential from the de) -2.5 E(vice,)-.25 E 5(3. remo)118 225.6 R -.15(ve)-.15 G 10.689(st).15 G -(he)-10.689 E F4(xyz.nabijaczleweli:tzpfms.)10.689 E F0({)A F4(backend)A -F0(,)A F4(key)14.189 E F0 10.689(}p)C 8.189(roperties from)-10.689 F F3 -(dataset)133 237.6 Q F0(.)A -.15(Fo)108 254.4 S 5.859(re).15 G -.15(ve) --6.109 G 3.359(ry remo).15 F -.25(va)-.15 G 5.859(lf).25 G 3.359 -(ailure and missing de)-5.959 F 3.36 -(vice or PIN an instruction for manual remo)-.25 F -.25(va)-.15 G 5.86 -(lw).25 G(ith)-5.86 E F4(fido2-token)108 266.4 Q F0(\(1\) is issued.)A -(See)108 283.2 Q F4(zfs-fido2-change-key)2.5 E F0 -(\(8\) for a detailed description.)A F1(ENVIR)72 300 Q 1.666(ONMENT V) --.3 F(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 312 Q F0 .046 -(By def)133 324 R .045(ault, passphrases are prompted for and read in o\ -n the standard output and input streams.)-.1 F(If)5.045 E F4 -(TZPFMS_PASSPHRASE_HELPER)133 336 Q F0 1.595(is set and nonempty)4.095 F -4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F4 -(/bin/)4.096 E F2 3.262(sh \255c)B F0(to)4.096 E(pro)133 348 Q -(vide each passphrase, instead.)-.15 E .643 -(The standard output stream of the helper is tied to an anon)133 364.8 R -.643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) -133 376.8 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F4($1)143 388.8 Q F0 -(Pre-formatted noun phrase with all the information belo)160 388.8 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E F4($2)143 400.8 Q F0 -(Either the dataset name or the de)160 400.8 Q -(vice feature being prompted for)-.25 E F4($3)143 412.8 Q F0("ne)160 -412.8 Q(w" if this is for a ne)-.25 E 2.5(wp)-.25 G -(assphrase, otherwise blank)-2.5 E F4($4)143 424.8 Q F0("ag)160 424.8 Q -(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .177 -(If the helper doesn')133 441.6 R 2.677(te)-.18 G .177 -(xist \(the shell e)-2.827 F .177(xits with)-.15 F F1(127)2.677 E F0 -.178(\), a diagnostic is issued and the normal prompt)B(is used as f)133 -453.6 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 -G(ther reason, the prompting is aborted.)-2.5 E F1 1.666 -(FIDO2 back-end con\214guration)72 470.4 R(En)87 482.4 Q(vir)-.4 E .625 -(onment v)-.18 F(ariables)-.1 E F4(FIDO_DEBUG)108 494.4 Q F0 -(If set, enables lib\214do2 deb)173 494.4 Q -(ug logging to the standard error stream.)-.2 E F1(De)87 511.2 Q .625 -(vice selection)-.15 F F0 .727(When creating, the \214rst de)108 523.2 R -.727(vice which supports the)-.25 F F4(hmac-secret)3.226 E F0 -.15(ex) -3.226 G .726(tension is used.).15 F .726(When loading,)5.726 F -(the assertion yielding the k)108 535.2 Q .3 -.15(ey i)-.1 H 2.5(ss).15 -G(hopped around to e)-2.5 E -.15(ve)-.25 G(ry such de).15 E(vice.)-.25 E -F1 .625(See also)87 552 R F0(The lib\214do2 documentation at https://de) -108 564 Q -.15(ve)-.25 G(lopers.yubico.com/lib\214do2/.).15 E F1 1.666 -(SPECIAL THANKS)72 580.8 R F0 1.6 -.8(To a)108 592.8 T -(ll who support further de).8 E -.15(ve)-.25 G(lopment, in particular:) -.15 E F1<83>128 604.8 Q F0(ThePhD)7.5 E F1<83>128 616.8 Q F0 -(Embark Studios)7.5 E F1<83>128 628.8 Q F0(Jasper Bekk)7.5 E(ers)-.1 E -F1<83>128 640.8 Q F0(EvModder)7.5 E F1(REPOR)72 657.6 Q 1.666(TING B)-.4 -F(UGS)-.1 E F0(https://todo.sr)108 669.6 Q(.ht/\001nabijaczle)-.55 E -(weli/fzifdso)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 686.4 -Q F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 -E(https://lists.sr)108 698.4 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.) --.25 E(fzifdso 0.4.0)72 817.889 Q(March 11, 2024)143.568 E(1)188.837 E 0 -Cg EP -%%Page: 1 5 -%%BeginPageSetup -BP -%%EndPageSetup -/F0 10/Times-Roman@0 SF(ZFS-FIDO2-LO)72 48 Q 55.603(AD-KEY\(8\) System) --.35 F(Manager')2.5 E 2.5(sM)-.55 G 53.102(anual ZFS-FIDO2-LO)-2.5 F -(AD-KEY\(8\))-.35 E/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10 -/Courier-Bold@0 SF(zfs-fido2-load-key)108 96 Q F0 2.5<8a6c>2.5 G -(oad FIDO2-encrypted ZFS dataset k)-2.5 E -.15(ey)-.1 G F1(SYNOPSIS)72 -112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([)2.5 E F21.666 E -F0(])A/F3 10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 -Q F0 1.789(After v)108 153.6 R(erifying)-.15 E F3(dataset)4.289 E F0 -.1 -(wa)4.289 G 4.289(se).1 G 1.789(ncrypted with the)-4.289 F F2(tzpfms) -4.289 E F1(FIDO2)4.289 E F0(back)4.289 E 1.788(end, asserts the preserv) --.1 F(ed)-.15 E(challenge, HMA)108 165.6 Q -(Cking the salt with the on-de)-.4 E -(vice secret, and loads the resulting k)-.25 E .3 -.15(ey i)-.1 H(nto) -.15 E F3(dataset)2.5 E F0(.)A(See)108 182.4 Q/F4 10/Courier@0 SF -(zfs-fido2-change-key)2.5 E F0(\(8\) for a detailed description.)A F1 -(OPTIONS)72 199.2 Q F2109.666 211.2 Q F0 3.208 -(Do a no-op/dry run, can be used e)131 211.2 R -.15(ve)-.25 G 5.708(ni) -.15 G 5.708(ft)-5.708 G 3.208(he k)-5.708 F 3.508 -.15(ey i)-.1 H 5.708 -(sa).15 G 3.208(lready loaded.)-5.708 F(Equi)8.208 E -.25(va)-.25 G -3.208(lent to).25 F F2(zfs)5.708 E(load-key)131 223.2 Q F0 -.55('s)C F2 -4.716 E F0(option.)2.5 E F1(ENVIR)72 240 Q 1.666(ONMENT V)-.3 F -(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 252 Q F0 .046(By def) -133 264 R .045(ault, passphrases are prompted for and read in on the st\ -andard output and input streams.)-.1 F(If)5.045 E F4 -(TZPFMS_PASSPHRASE_HELPER)133 276 Q F0 1.595(is set and nonempty)4.095 F -4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F4 -(/bin/)4.096 E F2 3.262(sh \255c)B F0(to)4.096 E(pro)133 288 Q -(vide each passphrase, instead.)-.15 E .643 -(The standard output stream of the helper is tied to an anon)133 304.8 R -.643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) -133 316.8 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F4($1)143 328.8 Q F0 -(Pre-formatted noun phrase with all the information belo)160 328.8 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E F4($2)143 340.8 Q F0 -(Either the dataset name or the de)160 340.8 Q -(vice feature being prompted for)-.25 E F4($3)143 352.8 Q F0("ne)160 -352.8 Q(w" if this is for a ne)-.25 E 2.5(wp)-.25 G -(assphrase, otherwise blank)-2.5 E F4($4)143 364.8 Q F0("ag)160 364.8 Q -(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .177 -(If the helper doesn')133 381.6 R 2.677(te)-.18 G .177 -(xist \(the shell e)-2.827 F .177(xits with)-.15 F F1(127)2.677 E F0 -.178(\), a diagnostic is issued and the normal prompt)B(is used as f)133 -393.6 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 -G(ther reason, the prompting is aborted.)-2.5 E F1 1.666 -(FIDO2 back-end con\214guration)72 410.4 R(En)87 422.4 Q(vir)-.4 E .625 -(onment v)-.18 F(ariables)-.1 E F4(FIDO_DEBUG)108 434.4 Q F0 -(If set, enables lib\214do2 deb)173 434.4 Q -(ug logging to the standard error stream.)-.2 E F1(De)87 451.2 Q .625 -(vice selection)-.15 F F0 .727(When creating, the \214rst de)108 463.2 R -.727(vice which supports the)-.25 F F4(hmac-secret)3.226 E F0 -.15(ex) -3.226 G .726(tension is used.).15 F .726(When loading,)5.726 F -(the assertion yielding the k)108 475.2 Q .3 -.15(ey i)-.1 H 2.5(ss).15 -G(hopped around to e)-2.5 E -.15(ve)-.25 G(ry such de).15 E(vice.)-.25 E -F1 .625(See also)87 492 R F0(The lib\214do2 documentation at https://de) -108 504 Q -.15(ve)-.25 G(lopers.yubico.com/lib\214do2/.).15 E F1 1.666 -(SPECIAL THANKS)72 520.8 R F0 1.6 -.8(To a)108 532.8 T -(ll who support further de).8 E -.15(ve)-.25 G(lopment, in particular:) -.15 E F1<83>128 544.8 Q F0(ThePhD)7.5 E F1<83>128 556.8 Q F0 -(Embark Studios)7.5 E F1<83>128 568.8 Q F0(Jasper Bekk)7.5 E(ers)-.1 E -F1<83>128 580.8 Q F0(EvModder)7.5 E F1(REPOR)72 597.6 Q 1.666(TING B)-.4 -F(UGS)-.1 E F0(https://todo.sr)108 609.6 Q(.ht/\001nabijaczle)-.55 E -(weli/fzifdso)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 626.4 -Q F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 -E(https://lists.sr)108 638.4 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.) --.25 E(fzifdso 0.4.0)72 817.889 Q(March 11, 2024)143.568 E(1)188.837 E 0 -Cg EP -%%Page: 1 6 -%%BeginPageSetup -BP -%%EndPageSetup /F0 10/Times-Roman@0 SF 93.563(ZFS-TPM-LIST\(8\) System)72 48 R (Manager')2.5 E 2.5(sM)-.55 G 91.062(anual ZFS-TPM-LIST\(8\))-2.5 F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF (zfs-tpm-list)108 96 Q F0 2.5<8a70>2.5 G(rint dataset tzpfms metadata) --2.5 E F1(SYNOPSIS)72 112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([) -2.5 E F21.666 E F0 2.5(][)C F2-.834 E F0(|)A F21.666 E -/F3 10/Courier-Oblique@0 SF(depth)6 E F0 2.5(][)C F2-.834 E F0(|)A -F21.666 E F3(back-end)6 E F0 2.5(][)C F2-.834 E F0(|)A F2 -1.666 E F0(])A([)234 136.8 Q F3(filesystem)A F0(|)A F3(volume)A F0 +-2.5 E F1(SYNOPSIS)72 112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F2 +1.666 E F0 2.5(][)C F2-.834 E F0(|)A F21.666 E/F3 10 +/Courier-Oblique@0 SF(depth)6 E F0 2.5(][)C F2-.834 E F0(|)A F2 +1.666 E F3(back-end)6 E F0 2.5(][)C F2-.834 E F0(|)A F2 +1.666 E F0(])A([)186 136.8 Q F3(filesystem)A F0(|)A F3(volume)A F0 1.666(]...)C F1(DESCRIPTION)72 153.6 Q F0(Lists the follo)108 165.6 Q (wing properties on encryption roots:)-.25 E/F4 10/Courier@0 SF(name)128 177.6 Q(back-end)128 189.6 Q F0(the)187 189.6 Q F2(tzpfms)2.979 E F0 @@ -709,28 +326,26 @@ listed \212 by def)108 307.2 R .966(ault, those managed by)-.1 F F2 G(re una)-2.5 E -.25(va)-.2 G(ilable.).25 E F2109.666 446.4 Q F0 (List only encryption roots whose k)185 446.4 Q -.15(ey)-.1 G 2.5(sa).15 G(re a)-2.5 E -.25(va)-.2 G(ilable.).25 E F1(EXAMPLES)72 463.2 Q F4($) -108 475.2 Q F2(zfs-fido2-add-backup)6 E F4 72(NAME BACK-END)108 487.2 R -18(KEYSTATUS COHERENT)12 F 36(tarta-zoot TPM1.X)108 499.2 R 18 +108 475.2 Q F2(zfs-tpm-list)6 E F4 72(NAME BACK-END)108 487.2 R 18 +(KEYSTATUS COHERENT)12 F 36(tarta-zoot TPM1.X)108 499.2 R 18 (available yes)24 F 6(tarta-zoot/home TPM2)108 511.2 R 6 -(unavailable yes)36 F($)108 535.2 Q F2 1.666 -(zfs-fido2-add-backup \255ad0)6 F F4 24(NAME BACK-END)108 547.2 R 6 -(KEYSTATUS COHERENT)12 F 6(filling -)108 559.2 R 6(available yes)54 F($) -108 583.2 Q F2 1.666(zfs-fido2-add-backup \255b)6 F F1(TPM2)6 E F4 72 -(NAME BACK-END)108 595.2 R 18(KEYSTATUS COHERENT)12 F 6 -(tarta-zoot/home TPM2)108 607.2 R 6(unavailable yes)36 F($)108 631.2 Q -F2 1.666(zfs-fido2-add-backup \255ra)6 F F3(tarta-zoot)6 E F4 72 -(NAME BACK-END)108 643.2 R 18(KEYSTATUS COHERENT)12 F 36 -(tarta-zoot TPM1.X)108 655.2 R 18(available yes)24 F 6 -(tarta-zoot/home TPM2)108 667.2 R 6(unavailable yes)36 F 12 -(tarta-zoot/bkp -)108 679.2 R 18(available yes)54 F 18(tarta-zoot/vm -) -108 691.2 R 18(available yes)54 F($)108 715.2 Q F2 1.666 -(zfs-fido2-add-backup \255al)6 F F4 72(NAME BACK-END)108 727.2 R 6 +(unavailable yes)36 F($)108 535.2 Q F2 1.666(zfs-tpm-list \255ad0)6 F F4 +24(NAME BACK-END)108 547.2 R 6(KEYSTATUS COHERENT)12 F 6(filling -)108 +559.2 R 6(available yes)54 F($)108 583.2 Q F2 1.666(zfs-tpm-list \255b)6 +F F1(TPM2)6 E F4 72(NAME BACK-END)108 595.2 R 18(KEYSTATUS COHERENT)12 F +6(tarta-zoot/home TPM2)108 607.2 R 6(unavailable yes)36 F($)108 631.2 Q +F2 1.666(zfs-tpm-list \255ra)6 F F3(tarta-zoot)6 E F4 72(NAME BACK-END) +108 643.2 R 18(KEYSTATUS COHERENT)12 F 36(tarta-zoot TPM1.X)108 655.2 R +18(available yes)24 F 6(tarta-zoot/home TPM2)108 667.2 R 6 +(unavailable yes)36 F 12(tarta-zoot/bkp -)108 679.2 R 18(available yes) +54 F 18(tarta-zoot/vm -)108 691.2 R 18(available yes)54 F($)108 715.2 Q +F2 1.666(zfs-tpm-list \255al)6 F F4 72(NAME BACK-END)108 727.2 R 6 (KEYSTATUS COHERENT)12 F 54(filling -)108 739.2 R 6(available yes)54 F 36(tarta-zoot TPM1.X)108 751.2 R 6(available yes)24 F 12 (tarta-zoot/bkp -)108 763.2 R 6(available yes)54 F 18(tarta-zoot/vm -) -108 775.2 R 6(available yes)54 F F0(tzpfms 0.3.4-34-g48bebe9)72 817.889 -Q(December 4, 2022)83.583 E(1)183.842 E 0 Cg EP -%%Page: 2 7 +108 775.2 R 6(available yes)54 F F0(tzpfms 0.4.0)72 817.889 Q +(December 4, 2022)139.123 E(1)183.842 E 0 Cg EP +%%Page: 2 2 %%BeginPageSetup BP %%EndPageSetup @@ -745,9 +360,9 @@ BP E/F2 10/Courier@0 SF(\001nabijaczleweli/tzpfms@lists.sr.ht)108 189.6 Q F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E (https://lists.sr)108 201.6 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.) --.25 E(tzpfms 0.3.4-34-g48bebe9)72 817.889 Q(December 4, 2022)83.583 E -(2)183.842 E 0 Cg EP -%%Page: 1 8 +-.25 E(tzpfms 0.4.0)72 817.889 Q(December 4, 2022)139.123 E(2)183.842 E +0 Cg EP +%%Page: 1 3 %%BeginPageSetup BP %%EndPageSetup @@ -756,107 +371,104 @@ BP -2.5 F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF(zfs-tpm1x-change-key)108 96 Q F0 2.5<8a63>2.5 G(hange ZFS dataset k) -2.5 E .3 -.15(ey t)-.1 H 2.5(oo).15 G(ne stored on the TPM)-2.5 E F1 -(SYNOPSIS)72 112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([)2.5 E F2 -1.666 E/F3 10/Courier-Oblique@0 SF(backup-file)6 E F0 2.5(][)C F2 --.834 E F3(PCR)6 E F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C(])-1.666 -E F3(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 2.867 -.8(To n)108 153.6 -T 1.267(ormalise the).8 F F3(dataset)3.767 E F0(,)A F2 -(zfs-fido2-add-backup)3.766 E F0 1.266 -(will open its encryption root in its stead.)3.766 F F2 -(zfs-fido2-add-backup)108 165.6 Q F0(will)14.654 E/F4 10/Times-Italic@0 -SF(ne)14.654 E(ver)-.15 E F0 12.154(create or destro)14.654 F 14.655(ye) --.1 G 12.155(ncryption roots; use)-14.655 F/F5 10/Courier@0 SF -(zfs-change-key)108 177.6 Q F0(\(8\) for that.)A -(First, a connection is made to the TPM, which)108 194.4 Q F4(must)2.5 E -F0(be TPM-1.X-compatible.)2.5 E(If)108 211.2 Q F3(dataset)3.177 E F0 -.1 +(SYNOPSIS)72 112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F2 +1.666 E/F3 10/Courier-Oblique@0 SF(backup-file)6 E F0 2.5(][)C F2 +-.834 E F3(PCR)6 E F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C(])-1.666 E F3 +(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 6.867 -.8(To n)108 153.6 T +5.267(ormalise the).8 F F3(dataset)7.767 E F0(,)A F2(zfs-tpm-list)7.766 +E F0 5.266(will open its encryption root in its stead.)7.766 F F2 +(zfs-tpm-list)108 165.6 Q F0(will)2.5 E/F4 10/Times-Italic@0 SF(ne)2.5 E +(ver)-.15 E F0(create or destro)2.5 E 2.5(ye)-.1 G(ncryption roots; use) +-2.5 E/F5 10/Courier@0 SF(zfs-change-key)2.5 E F0(\(8\) for that.)A +(First, a connection is made to the TPM, which)108 182.4 Q F4(must)2.5 E +F0(be TPM-1.X-compatible.)2.5 E(If)108 199.2 Q F3(dataset)3.176 E F0 -.1 (wa)3.176 G 3.176(sp).1 G(re)-3.176 E .676(viously encrypted with)-.25 F F2(tzpfms)3.176 E F0 .676(and the)3.176 F F1(TPM1.X)3.176 E F0 .676 (back-end w)3.176 F .676(as used, the meta-)-.1 F .926 -(data will be silently cleared.)108 223.2 R .926 +(data will be silently cleared.)108 211.2 R .926 (Otherwise, or in case of an error)5.926 F 3.426(,d)-.4 G .926 (ata required for manual interv)-3.426 F(ention)-.15 E -(will be written to the standard error stream.)108 235.2 Q(Ne)108 252 Q -.295(xt, a ne)-.15 F 2.794(ww)-.25 G .294(rapping k)-2.794 F .594 -.15 +(will be written to the standard error stream.)108 223.2 Q(Ne)108 240 Q +.294(xt, a ne)-.15 F 2.794(ww)-.25 G .294(rapping k)-2.794 F .594 -.15 (ey i)-.1 H 2.794(sg).15 G .294(enerated on the TPM, optionally back) -2.794 F .294(ed up \(see)-.1 F F1(OPTIONS)2.794 E F0 .294 -(\), and sealed)B .585(on the TPM; the user is prompted for an optional\ - passphrase to protect the k)108 264 R .886 -.15(ey w)-.1 H .586 -(ith, and for the SRK).15 F(passphrase, set when taking o)108 276 Q +(\), and sealed)B .586(on the TPM; the user is prompted for an optional\ + passphrase to protect the k)108 252 R .885 -.15(ey w)-.1 H .585 +(ith, and for the SRK).15 F(passphrase, set when taking o)108 264 Q (wnership, if not "well-kno)-.25 E(wn" \(all zeroes\).)-.25 E(The follo) -108 292.8 Q(wing properties are set on)-.25 E F3(dataset)2.5 E F0(:)A F1 -<83>128 304.8 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1 -(TPM1.X)A<83>128 316.8 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A +108 280.8 Q(wing properties are set on)-.25 E F3(dataset)2.5 E F0(:)A F1 +<83>128 292.8 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1 +(TPM1.X)A<83>128 304.8 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A F3(parent-key-blob)A F2(:)A F3(sealed-object-blob)A F5(tzpfms.backend) -108 333.6 Q F0 2.207(identi\214es this dataset for w)4.708 F 2.207 -(ork with)-.1 F F1(TPM1.X)4.707 E F0(-back-ended)A F2(tzpfms)4.707 E F0 -(programs)4.707 E(\(namely)108 345.6 Q F5(zfs-tpm1x-change-key)37.248 E -F0(\(8\),)A F5(zfs-tpm1x-load-key)37.248 E F0 34.749(\(8\), and)B F5 -(zfs-tpm1x-clear-key)108 357.6 Q F0(\(8\)\).)A F5(tzpfms.key)108 374.4 Q -F0 1.412(is a colon-separated pair of he)3.913 F 1.412 -(xadecimal-string \(i.e. "4F7730" for "Ow0"\) blobs; the)-.15 F .867 -(\214rst one represents the RSA k)108 386.4 R 1.167 -.15(ey p)-.1 H .868 +108 321.6 Q F0 2.207(identi\214es this dataset for w)4.707 F 2.207 +(ork with)-.1 F F1(TPM1.X)4.707 E F0(-back-ended)A F2(tzpfms)4.708 E F0 +(programs)4.708 E(\(namely)108 333.6 Q F5(zfs-tpm1x-change-key)37.249 E +F0(\(8\),)A F5(zfs-tpm1x-load-key)37.248 E F0 34.748(\(8\), and)B F5 +(zfs-tpm1x-clear-key)108 345.6 Q F0(\(8\)\).)A F5(tzpfms.key)108 362.4 Q +F0 1.412(is a colon-separated pair of he)3.912 F 1.412 +(xadecimal-string \(i.e. "4F7730" for "Ow0"\) blobs; the)-.15 F .868 +(\214rst one represents the RSA k)108 374.4 R 1.168 -.15(ey p)-.1 H .867 (rotecting the blob, and it is protected with either the passphrase, if) -.15 F(pro)108 398.4 Q 1.414(vided, or the SHA1 constant)-.15 F F5 -(CE4CF677875B5EB8993591D5A9AF1ED24A3A8736)3.913 E F0 3.913(;t)C 1.413 -(he sec-)-3.913 F .379 -(ond represents the sealed object containing the wrapping k)108 410.4 R +.15 F(pro)108 386.4 Q 1.413(vided, or the SHA1 constant)-.15 F F5 +(CE4CF677875B5EB8993591D5A9AF1ED24A3A8736)3.914 E F0 3.914(;t)C 1.414 +(he sec-)-3.914 F .379 +(ond represents the sealed object containing the wrapping k)108 398.4 R -.15(ey)-.1 G 2.879(,a)-.5 G .379 (nd is protected with the SHA1 constant)-2.879 F F5 -(B9EE715DBE4B243FAA81EA04306E063710383E35)108 422.4 Q F0 6.721(.T)C -1.721(here e)-6.721 F 1.721(xists no other user)-.15 F 1.72 -(-land tool for)-.2 F(decrypting this; perhaps there should be.)108 -434.4 Q(Finally)108 451.2 Q 12.005(,t)-.65 G 9.505(he equi)-12.005 F --.25(va)-.25 G 9.505(lent of).25 F F2 9.505(zfs change-key)12.005 F -17.172 E F5(keylocation=prompt)15.506 E F217.172 E F5 -(keyformat=raw)108 463.2 Q F3(dataset)6.107 E F0 .107 -(is performed with the ne)2.607 F 2.606(wk)-.25 G -.15(ey)-2.706 G 5.106 -(.I)-.5 G 2.606(fa)-5.106 G 2.606(ne)-2.606 G .106 -(rror occurred, best ef)-2.606 F .106(fort is made)-.25 F +(B9EE715DBE4B243FAA81EA04306E063710383E35)108 410.4 Q F0 6.72(.T)C 1.72 +(here e)-6.72 F 1.721(xists no other user)-.15 F 1.721(-land tool for) +-.2 F(decrypting this; perhaps there should be.)108 422.4 Q(Finally)108 +439.2 Q 12.006(,t)-.65 G 9.506(he equi)-12.006 F -.25(va)-.25 G 9.506 +(lent of).25 F F2 9.505(zfs change-key)12.005 F17.171 E F5 +(keylocation=prompt)15.505 E F217.171 E F5(keyformat=raw)108 451.2 +Q F3(dataset)6.106 E F0 .106(is performed with the ne)2.606 F 2.606(wk) +-.25 G -.15(ey)-2.706 G 5.106(.I)-.5 G 2.606(fa)-5.106 G 2.606(ne)-2.606 +G .107(rror occurred, best ef)-2.606 F .107(fort is made)-.25 F (to clean up the properties, or to issue a note for manual interv)108 -475.2 Q(ention into the standard error stream.)-.15 E 4.055<418c>108 492 -S 1.555(nal v)-4.055 F 1.556(eri\214cation should be made by running) --.15 F F2 3.222(zfs-tpm1x-load-key \255n)4.056 F F3(dataset)7.556 E F0 -6.556(.I)C 4.056(ft)-6.556 G(hat)-4.056 E .729 -(command succeeds, all is well, b)108 504 R .729 +463.2 Q(ention into the standard error stream.)-.15 E 4.056<418c>108 480 +S 1.556(nal v)-4.056 F 1.556(eri\214cation should be made by running) +-.15 F F2 3.222(zfs-tpm1x-load-key \255n)4.056 F F3(dataset)7.555 E F0 +6.555(.I)C 4.055(ft)-6.555 G(hat)-4.055 E .729 +(command succeeds, all is well, b)108 492 R .729 (ut otherwise the dataset can be manually rolled back to a passphrase) --.2 F(with)108 516 Q F2(zfs-tpm1x-clear-key)5.146 E F3(dataset)8.646 E -F0(\(or)5.146 E 5.146(,i)-.4 G 5.146(ft)-5.146 G 2.646(hat f)-5.146 F -2.646(ails to w)-.1 F(ork,)-.1 E F2 2.647(zfs change-key)5.147 F -10.313 E F5(keyformat=passphrase)108 528 Q F3(dataset)6 E F0 +-.2 F(with)108 504 Q F2(zfs-tpm1x-clear-key)5.147 E F3(dataset)8.647 E +F0(\(or)5.147 E 5.146(,i)-.4 G 5.146(ft)-5.146 G 2.646(hat f)-5.146 F +2.646(ails to w)-.1 F(ork,)-.1 E F2 2.646(zfs change-key)5.146 F +10.312 E F5(keyformat=passphrase)108 516 Q F3(dataset)6 E F0 (\), and you are hereby ask)A(ed to report a b)-.1 E(ug, please.)-.2 E -F2(zfs-tpm1x-clear-key)108 544.8 Q F3(dataset)7.607 E F0 1.607 -(can be used to clear the properties and go back to using a)4.107 F -(passphrase.)108 556.8 Q F1(OPTIONS)72 573.6 Q F2109.666 585.6 Q -F3(backup-file)6 E F0(Sa)203 585.6 Q .352 -.15(ve a b)-.2 H .052 +F2(zfs-tpm1x-clear-key)108 532.8 Q F3(dataset)7.606 E F0 1.607 +(can be used to clear the properties and go back to using a)4.106 F +(passphrase.)108 544.8 Q F1(OPTIONS)72 561.6 Q F2109.666 573.6 Q +F3(backup-file)6 E F0(Sa)203 573.6 Q .353 -.15(ve a b)-.2 H .052 (ack-up of the k).15 F .352 -.15(ey t)-.1 H(o).15 E F3(backup-file)2.552 -E F0 2.552(,w)C .052(hich must not e)-2.552 F .053(xist beforehand.)-.15 -F .694(This back-up)203 597.6 R F4(must)3.194 E F0 .694 -(be stored securely)3.194 F 3.194(,o)-.65 G -.25(ff)-3.194 G 3.194 -(-site. In).25 F .693(case of a catastrophic e)3.194 F -.15(ve)-.25 G -(nt,).15 E(the k)203 609.6 Q .3 -.15(ey c)-.1 H(an be loaded by running) -.15 E F2(zfs load-key)233 621.6 Q F3(dataset)6 E F5(<)6 E F3 -(backup-file)6 E F2109.666 638.4 Q F3(PCR)6 E F0([)A F2(,)A F3 -(PCR)A F0 1.666(]...)C .638(Bind the k)203 638.4 R .939 -.15(ey t)-.1 H +E F0 2.552(,w)C .052(hich must not e)-2.552 F .052(xist beforehand.)-.15 +F .693(This back-up)203 585.6 R F4(must)3.193 E F0 .694 +(be stored securely)3.193 F 3.194(,o)-.65 G -.25(ff)-3.194 G 3.194 +(-site. In).25 F .694(case of a catastrophic e)3.194 F -.15(ve)-.25 G +(nt,).15 E(the k)203 597.6 Q .3 -.15(ey c)-.1 H(an be loaded by running) +.15 E F2(zfs load-key)233 609.6 Q F3(dataset)6 E F5(<)6 E F3 +(backup-file)6 E F2109.666 626.4 Q F3(PCR)6 E F0([)A F2(,)A F3 +(PCR)A F0 1.666(]...)C .639(Bind the k)203 626.4 R .939 -.15(ey t)-.1 H 3.139(os).15 G .639(pace- or comma-separated)-3.139 F F3(PCR)3.139 E F0 -3.139(s\212i)C 3.139(ft)-3.139 G(he)-3.139 E 3.139(yc)-.15 G .639 -(hange, the wrap-)-3.139 F .463(ping k)203 650.4 R .763 -.15(ey w)-.1 H -.463(ill not be able to be unsealed.).15 F .462 -(The minimum number of PCRs for a)5.462 F(PC TPM is)203 662.4 Q F1(24) +3.139(s\212i)C 3.139(ft)-3.139 G(he)-3.139 E 3.139(yc)-.15 G .638 +(hange, the wrap-)-3.139 F .462(ping k)203 638.4 R .762 -.15(ey w)-.1 H +.462(ill not be able to be unsealed.).15 F .463 +(The minimum number of PCRs for a)5.462 F(PC TPM is)203 650.4 Q F1(24) 2.5 E F0(\(numbered [)2.5 E F1(0)A F0(,)A F1(23)2.5 E F0 2.5(]\). F)B -(or most, this is also the maximum.)-.15 E F1(ENVIR)72 679.2 Q 1.666 -(ONMENT V)-.3 F(ARIABLES)-1.35 E F5(TZPFMS_PASSPHRASE_HELPER)108 691.2 Q -F0 .045(By def)133 703.2 R .045(ault, passphrases are prompted for and \ -read in on the standard output and input streams.)-.1 F(If)5.046 E F5 -(TZPFMS_PASSPHRASE_HELPER)133 715.2 Q F0 1.596(is set and nonempty)4.096 +(or most, this is also the maximum.)-.15 E F1(ENVIR)72 667.2 Q 1.666 +(ONMENT V)-.3 F(ARIABLES)-1.35 E F5(TZPFMS_PASSPHRASE_HELPER)108 679.2 Q +F0 .046(By def)133 691.2 R .045(ault, passphrases are prompted for and \ +read in on the standard output and input streams.)-.1 F(If)5.045 E F5 +(TZPFMS_PASSPHRASE_HELPER)133 703.2 Q F0 1.595(is set and nonempty)4.095 F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F5 -(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 727.2 Q +(/bin/)4.096 E F2 3.262(sh \255c)B F0(to)4.096 E(pro)133 715.2 Q (vide each passphrase, instead.)-.15 E .643 -(The standard output stream of the helper is tied to an anon)133 744 R +(The standard output stream of the helper is tied to an anon)133 732 R .643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) -133 756 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E(tzpfms 0.3.4-34-g48bebe9)72 -817.889 Q(March 11, 2024)88.578 E(1)188.837 E 0 Cg EP -%%Page: 2 9 +133 744 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 +(y. T)-.15 H(he ar).65 E(guments are:)-.18 E(tzpfms 0.4.0)72 817.889 Q +(March 11, 2024)144.118 E(1)188.837 E 0 Cg EP +%%Page: 2 4 %%BeginPageSetup BP %%EndPageSetup @@ -869,23 +481,23 @@ BP (yb)-.05 G(eing prompted for)-2.5 E F1($3)143 108 Q F0("ne)160 108 Q (w" if this is for a ne)-.25 E 2.5(wp)-.25 G(assphrase, otherwise blank) -2.5 E F1($4)143 120 Q F0("ag)160 120 Q(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .178 -(If the helper doesn')133 136.8 R 2.678(te)-.18 G .178 -(xist \(the shell e)-2.828 F .177(xits with)-.15 F/F2 10/Times-Bold@0 SF -(127)2.677 E F0 .177(\), a diagnostic is issued and the normal prompt)B +(he second prompt for that passphrase, otherwise blank)-2.5 E .177 +(If the helper doesn')133 136.8 R 2.677(te)-.18 G .177 +(xist \(the shell e)-2.827 F .177(xits with)-.15 F/F2 10/Times-Bold@0 SF +(127)2.677 E F0 .178(\), a diagnostic is issued and the normal prompt)B (is used as f)133 148.8 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an) -.1 E 2.5(yo)-.15 G(ther reason, the prompting is aborted.)-2.5 E F2 1.666(TPM1.X back-end con\214guration)72 165.6 R .625(TPM selection)87 -177.6 R F0(The)108 189.6 Q/F3 10/Courier-Bold@0 SF(tzpfms)2.729 E F0 -.229(suite connects to a local)2.729 F F1(tcsd)2.73 E F0 .23 -(\(8\) process \(at)B F1(localhost:30003)2.73 E F0 2.73(\)b)C 2.73(yd) --2.73 G(ef)-2.73 E 2.73(ault. Use)-.1 F(the)2.73 E(en)108 201.6 Q -(vironment v)-.4 E(ariable)-.25 E F1(TZPFMS_TPM1X)2.5 E F0 -(to specify a remote TCS hostname.)2.5 E .111(The T)108 218.4 R(rouSerS) --.35 E F1(tcsd)2.611 E F0 .111(\(8\) daemon will try)B F1(/dev/tpm0)2.61 -E F0 2.61(,t)C(hen)-2.61 E F1(/udev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E -F1(/dev/tpm)2.61 E F0 2.61(;b)C 2.61(yo)-2.61 G(ccu-)-2.61 E -.1(py)108 -230.4 S(ing one of the earlier ones with, for e).1 E +177.6 R F0(The)108 189.6 Q/F3 10/Courier-Bold@0 SF(tzpfms)2.73 E F0 .23 +(suite connects to a local)2.73 F F1(tcsd)2.73 E F0 .23 +(\(8\) process \(at)B F1(localhost:30003)2.729 E F0 2.729(\)b)C 2.729 +(yd)-2.729 G(ef)-2.729 E 2.729(ault. Use)-.1 F(the)2.729 E(en)108 201.6 +Q(vironment v)-.4 E(ariable)-.25 E F1(TZPFMS_TPM1X)2.5 E F0 +(to specify a remote TCS hostname.)2.5 E .11(The T)108 218.4 R(rouSerS) +-.35 E F1(tcsd)2.61 E F0 .11(\(8\) daemon will try)B F1(/dev/tpm0)2.61 E +F0 2.61(,t)C(hen)-2.61 E F1(/udev/tpm0)2.611 E F0 2.611(,t)C(hen)-2.611 +E F1(/dev/tpm)2.611 E F0 2.611(;b)C 2.611(yo)-2.611 G(ccu-)-2.611 E -.1 +(py)108 230.4 S(ing one of the earlier ones with, for e).1 E (xample, shell redirection, a later one can be selected.)-.15 E F2 .625 (See also)87 247.2 R F0(The T)108 259.2 Q (rouSerS project page at https://sourcefor)-.35 E @@ -900,7 +512,7 @@ F1(/dev/tpm)2.61 E F0 2.61(;b)C 2.61(yo)-2.61 G(ccu-)-2.61 E -.1(py)108 F2<83>128 364.8 Q F0(EvModder)7.5 E F2(REPOR)72 381.6 Q 1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 393.6 Q(.ht/\001nabijaczle)-.55 E (weli/tzpfms)-.25 E F1(\001nabijaczleweli/tzpfms@lists.sr.ht)108 410.4 Q -F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E +F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E (https://lists.sr)108 422.4 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.) -.25 E F2 1.666(SEE ALSO)72 439.2 R F0 (PCR allocations: https://wiki.archlinux.or)108 451.2 Q(g/title/T)-.18 E @@ -908,42 +520,42 @@ F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E (and https://trustedcomputinggroup.or)108 463.2 Q (g/wp-content/uploads/PC-)-.18 E(ClientSpeci\214c_Platform_Pro\214le_fo\ r_TPM_2p0_Systems_v51.pdf, Section 2.3.4 "PCR Usage", T)108 475.2 Q -(able)-.8 E(1.)108 487.2 Q(tzpfms 0.3.4-34-g48bebe9)72 817.889 Q -(March 11, 2024)88.578 E(2)188.837 E 0 Cg EP -%%Page: 1 10 +(able)-.8 E(1.)108 487.2 Q(tzpfms 0.4.0)72 817.889 Q(March 11, 2024) +144.118 E(2)188.837 E 0 Cg EP +%%Page: 1 5 %%BeginPageSetup BP %%EndPageSetup /F0 10/Times-Roman@0 SF 45.793(ZFS-TPM1X-CLEAR-KEY\(8\) System)72 48 R (Manager')2.5 E 2.5(sM)-.55 G 43.292(anual ZFS-TPM1X-CLEAR-KEY\(8\))-2.5 F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF -(zfs-tpm1x-clear-key)108 96 Q F0 3.008<8a72>3.007 G -.25(ew)-3.008 G +(zfs-tpm1x-clear-key)108 96 Q F0 3.008<8a72>3.008 G -.25(ew)-3.008 G .508(rap ZFS dataset k).25 F .808 -.15(ey i)-.1 H 3.008(np).15 G(asssw) -3.008 E .508(ord and clear tzpfms TPM1.X meta-)-.1 F(data)108 108 Q F1 -(SYNOPSIS)72 124.8 Q F2(zfs-fido2-add-backup)108 136.8 Q/F3 10 -/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0 -(After v)108 165.6 Q(erifying)-.15 E F3(dataset)2.5 E F0 -.1(wa)2.5 G -2.5(se).1 G(ncrypted with the)-2.5 E F2(tzpfms)2.5 E F1(TPM1.X)2.5 E F0 -(back)2.5 E(end:)-.1 E 5(1. performs)118 177.6 R 5.642(the equi)8.142 F --.25(va)-.25 G 5.642(lent of).25 F F2 5.642(zfs change-key)8.142 F -13.307 E/F4 10/Courier@0 SF(keylocation=prompt)11.641 E F213.307 E -F4(keyformat=passphrase)133 189.6 Q F3(dataset)6 E F0(,)A 5(2. remo)118 +(SYNOPSIS)72 124.8 Q F2(zfs-tpm-list)108 136.8 Q/F3 10/Courier-Oblique@0 +SF(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0(After v)108 165.6 Q +(erifying)-.15 E F3(dataset)2.5 E F0 -.1(wa)2.5 G 2.5(se).1 G +(ncrypted with the)-2.5 E F2(tzpfms)2.5 E F1(TPM1.X)2.5 E F0(back)2.5 E +(end:)-.1 E 5(1. performs)118 177.6 R 5.641(the equi)8.141 F -.25(va) +-.25 G 5.641(lent of).25 F F2 5.642(zfs change-key)8.142 F13.308 E +/F4 10/Courier@0 SF(keylocation=prompt)11.642 E F213.308 E F4 +(keyformat=passphrase)133 189.6 Q F3(dataset)6 E F0(,)A 5(2. remo)118 201.6 R -.15(ve)-.15 G 10.689(st).15 G(he)-10.689 E F4 (xyz.nabijaczleweli:tzpfms.)10.689 E F0({)A F4(backend)A F0(,)A F4(key) 14.189 E F0 10.689(}p)C 8.189(roperties from)-10.689 F F3(dataset)133 213.6 Q F0(.)A(See)108 230.4 Q F4(zfs-tpm1x-change-key)2.5 E F0 (\(8\) for a detailed description.)A F1 1.666 (TPM1.X back-end con\214guration)72 247.2 R .625(TPM selection)87 259.2 -R F0(The)108 271.2 Q F2(tzpfms)2.73 E F0 .23(suite connects to a local) -2.73 F F4(tcsd)2.73 E F0 .23(\(8\) process \(at)B F4(localhost:30003) -2.729 E F0 2.729(\)b)C 2.729(yd)-2.729 G(ef)-2.729 E 2.729(ault. Use)-.1 -F(the)2.729 E(en)108 283.2 Q(vironment v)-.4 E(ariable)-.25 E F4 -(TZPFMS_TPM1X)2.5 E F0(to specify a remote TCS hostname.)2.5 E .11 -(The T)108 300 R(rouSerS)-.35 E F4(tcsd)2.61 E F0 .11 -(\(8\) daemon will try)B F4(/dev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E F4 -(/udev/tpm0)2.611 E F0 2.611(,t)C(hen)-2.611 E F4(/dev/tpm)2.611 E F0 -2.611(;b)C 2.611(yo)-2.611 G(ccu-)-2.611 E -.1(py)108 312 S -(ing one of the earlier ones with, for e).1 E +R F0(The)108 271.2 Q F2(tzpfms)2.729 E F0 .229 +(suite connects to a local)2.729 F F4(tcsd)2.73 E F0 .23 +(\(8\) process \(at)B F4(localhost:30003)2.73 E F0 2.73(\)b)C 2.73(yd) +-2.73 G(ef)-2.73 E 2.73(ault. Use)-.1 F(the)2.73 E(en)108 283.2 Q +(vironment v)-.4 E(ariable)-.25 E F4(TZPFMS_TPM1X)2.5 E F0 +(to specify a remote TCS hostname.)2.5 E .111(The T)108 300 R(rouSerS) +-.35 E F4(tcsd)2.611 E F0 .111(\(8\) daemon will try)B F4(/dev/tpm0)2.61 +E F0 2.61(,t)C(hen)-2.61 E F4(/udev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E +F4(/dev/tpm)2.61 E F0 2.61(;b)C 2.61(yo)-2.61 G(ccu-)-2.61 E -.1(py)108 +312 S(ing one of the earlier ones with, for e).1 E (xample, shell redirection, a later one can be selected.)-.15 E F1 .625 (See also)87 328.8 R F0(The T)108 340.8 Q (rouSerS project page at https://sourcefor)-.35 E @@ -958,11 +570,10 @@ F(the)2.729 E(en)108 283.2 Q(vironment v)-.4 E(ariable)-.25 E F4 F1<83>128 446.4 Q F0(EvModder)7.5 E F1(REPOR)72 463.2 Q 1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 475.2 Q(.ht/\001nabijaczle)-.55 E (weli/tzpfms)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 492 Q -F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E +F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E (https://lists.sr)108 504 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 -E(tzpfms 0.3.4-34-g48bebe9)72 817.889 Q(March 11, 2024)88.578 E(1) -188.837 E 0 Cg EP -%%Page: 1 11 +E(tzpfms 0.4.0)72 817.889 Q(March 11, 2024)144.118 E(1)188.837 E 0 Cg EP +%%Page: 1 6 %%BeginPageSetup BP %%EndPageSetup @@ -971,15 +582,15 @@ BP (AD-KEY\(8\))-.35 E/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10 /Courier-Bold@0 SF(zfs-tpm1x-load-key)108 96 Q F0 2.5<8a6c>2.5 G (oad TPM1.X-encrypted ZFS dataset k)-2.5 E -.15(ey)-.1 G F1(SYNOPSIS)72 -112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([)2.5 E F21.666 E -F0(])A/F3 10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 -Q F0 1.488(After v)108 153.6 R(erifying)-.15 E F3(dataset)3.988 E F0 -.1 -(wa)3.988 G 3.988(se).1 G 1.487(ncrypted with the)-3.988 F F2(tzpfms) -3.987 E F1(TPM1.X)3.987 E F0(back)3.987 E 1.487(end, unseals the k)-.1 F -1.787 -.15(ey a)-.1 H(nd).15 E(load it into)108 165.6 Q F3(dataset)2.5 E -F0(.)A .236 +112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F21.666 E F0(])A/F3 +10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 1.487 +(After v)108 153.6 R(erifying)-.15 E F3(dataset)3.987 E F0 -.1(wa)3.987 +G 3.987(se).1 G 1.487(ncrypted with the)-3.987 F F2(tzpfms)3.987 E F1 +(TPM1.X)3.987 E F0(back)3.987 E 1.488(end, unseals the k)-.1 F 1.788 +-.15(ey a)-.1 H(nd).15 E(load it into)108 165.6 Q F3(dataset)2.5 E F0(.) +A .236 (The user is \214rst prompted for the SRK passphrase, set when taking o) -108 182.4 R .236(wnership, if not "well-kno)-.25 F .236(wn" \(all)-.25 F +108 182.4 R .236(wnership, if not "well-kno)-.25 F .235(wn" \(all)-.25 F (zeroes\); then for the additional passphrase, set when creating the k) 108 194.4 Q -.15(ey)-.1 G 2.5(,i)-.5 G 2.5(fo)-2.5 G(ne w)-2.5 E (as set.)-.1 E(See)108 211.2 Q/F4 10/Courier@0 SF(zfs-tpm1x-change-key) @@ -987,14 +598,14 @@ F0(.)A .236 109.666 240 Q F0 3.208(Do a no-op/dry run, can be used e)131 240 R -.15(ve)-.25 G 5.708(ni).15 G 5.708(ft)-5.708 G 3.208(he k)-5.708 F 3.508 -.15(ey i)-.1 H 5.708(sa).15 G 3.208(lready loaded.)-5.708 F(Equi) -8.207 E -.25(va)-.25 G 3.207(lent to).25 F F2(zfs)5.707 E(load-key)131 +8.208 E -.25(va)-.25 G 3.208(lent to).25 F F2(zfs)5.708 E(load-key)131 252 Q F0 -.55('s)C F24.716 E F0(option.)2.5 E F1(ENVIR)72 268.8 Q 1.666(ONMENT V)-.3 F(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 -280.8 Q F0 .045(By def)133 292.8 R .045(ault, passphrases are prompted \ -for and read in on the standard output and input streams.)-.1 F(If)5.046 -E F4(TZPFMS_PASSPHRASE_HELPER)133 304.8 Q F0 1.596(is set and nonempty) -4.096 F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F -F4(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 316.8 Q +280.8 Q F0 .046(By def)133 292.8 R .045(ault, passphrases are prompted \ +for and read in on the standard output and input streams.)-.1 F(If)5.045 +E F4(TZPFMS_PASSPHRASE_HELPER)133 304.8 Q F0 1.595(is set and nonempty) +4.095 F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F +F4(/bin/)4.096 E F2 3.262(sh \255c)B F0(to)4.096 E(pro)133 316.8 Q (vide each passphrase, instead.)-.15 E .643 (The standard output stream of the helper is tied to an anon)133 333.6 R .643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) @@ -1007,23 +618,23 @@ F4(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 316.8 Q 381.6 Q(w" if this is for a ne)-.25 E 2.5(wp)-.25 G (assphrase, otherwise blank)-2.5 E F4($4)143 393.6 Q F0("ag)160 393.6 Q (ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .178 -(If the helper doesn')133 410.4 R 2.678(te)-.18 G .178 -(xist \(the shell e)-2.828 F .177(xits with)-.15 F F1(127)2.677 E F0 -.177(\), a diagnostic is issued and the normal prompt)B(is used as f)133 +(he second prompt for that passphrase, otherwise blank)-2.5 E .177 +(If the helper doesn')133 410.4 R 2.677(te)-.18 G .177 +(xist \(the shell e)-2.827 F .177(xits with)-.15 F F1(127)2.677 E F0 +.178(\), a diagnostic is issued and the normal prompt)B(is used as f)133 422.4 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 G(ther reason, the prompting is aborted.)-2.5 E F1 1.666 (TPM1.X back-end con\214guration)72 439.2 R .625(TPM selection)87 451.2 -R F0(The)108 463.2 Q F2(tzpfms)2.729 E F0 .229 -(suite connects to a local)2.729 F F4(tcsd)2.73 E F0 .23 -(\(8\) process \(at)B F4(localhost:30003)2.73 E F0 2.73(\)b)C 2.73(yd) --2.73 G(ef)-2.73 E 2.73(ault. Use)-.1 F(the)2.73 E(en)108 475.2 Q -(vironment v)-.4 E(ariable)-.25 E F4(TZPFMS_TPM1X)2.5 E F0 -(to specify a remote TCS hostname.)2.5 E .111(The T)108 492 R(rouSerS) --.35 E F4(tcsd)2.611 E F0 .111(\(8\) daemon will try)B F4(/dev/tpm0)2.61 -E F0 2.61(,t)C(hen)-2.61 E F4(/udev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E -F4(/dev/tpm)2.61 E F0 2.61(;b)C 2.61(yo)-2.61 G(ccu-)-2.61 E -.1(py)108 -504 S(ing one of the earlier ones with, for e).1 E +R F0(The)108 463.2 Q F2(tzpfms)2.73 E F0 .23(suite connects to a local) +2.73 F F4(tcsd)2.73 E F0 .23(\(8\) process \(at)B F4(localhost:30003) +2.729 E F0 2.729(\)b)C 2.729(yd)-2.729 G(ef)-2.729 E 2.729(ault. Use)-.1 +F(the)2.729 E(en)108 475.2 Q(vironment v)-.4 E(ariable)-.25 E F4 +(TZPFMS_TPM1X)2.5 E F0(to specify a remote TCS hostname.)2.5 E .11 +(The T)108 492 R(rouSerS)-.35 E F4(tcsd)2.61 E F0 .11 +(\(8\) daemon will try)B F4(/dev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E F4 +(/udev/tpm0)2.611 E F0 2.611(,t)C(hen)-2.611 E F4(/dev/tpm)2.611 E F0 +2.611(;b)C 2.611(yo)-2.611 G(ccu-)-2.611 E -.1(py)108 504 S +(ing one of the earlier ones with, for e).1 E (xample, shell redirection, a later one can be selected.)-.15 E F1 .625 (See also)87 520.8 R F0(The T)108 532.8 Q (rouSerS project page at https://sourcefor)-.35 E @@ -1038,11 +649,10 @@ F4(/dev/tpm)2.61 E F0 2.61(;b)C 2.61(yo)-2.61 G(ccu-)-2.61 E -.1(py)108 F1<83>128 638.4 Q F0(EvModder)7.5 E F1(REPOR)72 655.2 Q 1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 667.2 Q(.ht/\001nabijaczle)-.55 E (weli/tzpfms)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 684 Q -F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E +F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E (https://lists.sr)108 696 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 -E(tzpfms 0.3.4-34-g48bebe9)72 817.889 Q(March 11, 2024)88.578 E(1) -188.837 E 0 Cg EP -%%Page: 1 12 +E(tzpfms 0.4.0)72 817.889 Q(March 11, 2024)144.118 E(1)188.837 E 0 Cg EP +%%Page: 1 7 %%BeginPageSetup BP %%EndPageSetup @@ -1051,113 +661,113 @@ BP F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF (zfs-tpm2-change-key)108 96 Q F0 2.5<8a63>2.5 G(hange ZFS dataset k)-2.5 E .3 -.15(ey t)-.1 H 2.5(oo).15 G(ne stored on the TPM)-2.5 E F1 -(SYNOPSIS)72 112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([)2.5 E F2 -1.666 E/F3 10/Courier-Oblique@0 SF(backup-file)6 E F0 2.5(][)C F2 --.834 E F3(algorithm)6 E F2(:)A F3(PCR)A F0([)A F2(,)A F3(PCR)A F0 -1.666(]...)C([)234 136.8 Q F2(+)A F3(algorithm)A F2(:)A F3(PCR)A F0([)A -F2(,)A F3(PCR)A F0 1.666(]...)C -3.332 1.666(]... [)-1.666 H F2A -F0(]])A F3(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0 4.319 -.8(To n)108 -165.6 T(ormalise).8 E F3(dataset)5.219 E F0(,)A F2(zfs-fido2-add-backup) -5.219 E F0 2.72(will open its encryption root in its stead.)5.219 F F2 -(zfs-fido2-add-backup)108 177.6 Q F0(will)14.655 E/F4 10/Times-Italic@0 -SF(ne)14.655 E(ver)-.15 E F0 12.154(create or destro)14.655 F 14.654(ye) --.1 G 12.154(ncryption roots; use)-14.654 F/F5 10/Courier@0 SF -(zfs-change-key)108 189.6 Q F0(\(8\) for that.)A -(First, a connection is made to the TPM, which)108 206.4 Q F4(must)2.5 E -F0(be TPM-2.0-compatible.)2.5 E(If)108 223.2 Q F3(dataset)3.054 E F0 -.1 -(wa)3.054 G 3.054(sp).1 G(re)-3.054 E .554(viously encrypted with)-.25 F -F2(tzpfms)3.055 E F0 .555(and the)3.055 F F1(TPM2)3.055 E F0 .555 -(back-end w)3.055 F .555(as used, the pre)-.1 F(vious)-.25 E -.1(ke)108 -235.2 S 3.06(yw)-.05 G .56(ill be freed from the TPM.)-3.06 F .56 +(SYNOPSIS)72 112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F2 +1.666 E/F3 10/Courier-Oblique@0 SF(backup-file)6 E F0 2.5(][)C F2 +-.834 E F3(algorithm)6 E F2(:)A F3(PCR)A F0([)A F2(,)A F3(PCR)A F0 1.666 +(]...)C([)186 136.8 Q F2(+)A F3(algorithm)A F2(:)A F3(PCR)A F0([)A F2(,) +A F3(PCR)A F0 1.666(]...)C -3.332 1.666(]... [)-1.666 H F2A F0(]]) +A F3(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0 1.677 -.8(To n)108 165.6 +T(ormalise).8 E F3(dataset)2.577 E F0(,)A F2(zfs-tpm-list)2.577 E F0 +.076(will open its encryption root in its stead.)2.576 F F2 +(zfs-tpm-list)5.076 E F0(will)108 177.6 Q/F4 10/Times-Italic@0 SF(ne)2.5 +E(ver)-.15 E F0(create or destro)2.5 E 2.5(ye)-.1 G +(ncryption roots; use)-2.5 E/F5 10/Courier@0 SF(zfs-change-key)2.5 E F0 +(\(8\) for that.)A(First, a connection is made to the TPM, which)108 +194.4 Q F4(must)2.5 E F0(be TPM-2.0-compatible.)2.5 E(If)108 211.2 Q F3 +(dataset)3.054 E F0 -.1(wa)3.054 G 3.054(sp).1 G(re)-3.054 E .554 +(viously encrypted with)-.25 F F2(tzpfms)3.055 E F0 .555(and the)3.055 F +F1(TPM2)3.055 E F0 .555(back-end w)3.055 F .555(as used, the pre)-.1 F +(vious)-.25 E -.1(ke)108 223.2 S 3.06(yw)-.05 G .56 +(ill be freed from the TPM.)-3.06 F .56 (Otherwise, or in case of an error)5.56 F 3.059(,d)-.4 G .559 (ata required for manual interv)-3.059 F(en-)-.15 E -(tion will be written to the standard error stream.)108 247.2 Q(Ne)108 -264 Q .294(xt, a ne)-.15 F 2.794(ww)-.25 G .294(rapping k)-2.794 F .594 +(tion will be written to the standard error stream.)108 235.2 Q(Ne)108 +252 Q .294(xt, a ne)-.15 F 2.794(ww)-.25 G .294(rapping k)-2.794 F .594 -.15(ey i)-.1 H 2.794(sg).15 G .294 (enerated on the TPM, optionally back)-2.794 F .294(ed up \(see)-.1 F F1 (OPTIONS)2.794 E F0 .294(\), and sealed)B .589 -(to a persistent object on the TPM under the o)108 276 R .589 +(to a persistent object on the TPM under the o)108 264 R .589 (wner hierarch)-.25 F .588(y; if there is a passphrase set on the o)-.05 -F(wner)-.25 E(hierarch)108 288 Q 1.602 -.65(y, t)-.05 H .302 +F(wner)-.25 E(hierarch)108 276 Q 1.602 -.65(y, t)-.05 H .302 (he user is prompted for it; the user is al).65 F -.1(wa)-.1 G .302 (ys prompted for an optional passphrase to protect).1 F -(the sealed object with.)108 300 Q(The follo)108 316.8 Q +(the sealed object with.)108 288 Q(The follo)108 304.8 Q (wing properties are set on)-.25 E F3(dataset)2.5 E F0(:)A F1<83>128 -328.8 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1(TPM2)A<83> -128 340.8 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A F3 -(persistent-object-ID)A F0([)139 352.8 Q F2(;)A F3(algorithm)A F2(:)A F3 +316.8 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1(TPM2)A<83> +128 328.8 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A F3 +(persistent-object-ID)A F0([)139 340.8 Q F2(;)A F3(algorithm)A F2(:)A F3 (PCR)A F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C([)-1.666 E F2(+)A F3 (algorithm)A F2(:)A F3(PCR)A F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C -1.666(]...)-1.666 G(])-1.666 E F5(tzpfms.backend)108 369.6 Q F0 3.287 +1.666(]...)-1.666 G(])-1.666 E F5(tzpfms.backend)108 357.6 Q F0 3.287 (identi\214es this dataset for w)5.788 F 3.287(ork with)-.1 F F1(TPM2) 5.787 E F0(-back-ended)A F2(tzpfms)5.787 E F0(programs)5.787 E(\(namely) -108 381.6 Q F5(zfs-tpm2-change-key)41.248 E F0(\(8\),)A F5 +108 369.6 Q F5(zfs-tpm2-change-key)41.248 E F0(\(8\),)A F5 (zfs-tpm2-load-key)41.248 E F0 38.749(\(8\), and)B F5 -(zfs-tpm2-clear-key)108 393.6 Q F0(\(8\)\).)A F5(tzpfms.key)108 410.4 Q +(zfs-tpm2-clear-key)108 381.6 Q F0(\(8\)\).)A F5(tzpfms.key)108 398.4 Q F0 1.509(is an inte)4.009 F 1.509 (ger representing the sealed object, optionally follo)-.15 F 1.509 (wed by a semicolon and)-.25 F .822(PCR list as speci\214ed with)108 -422.4 R F24.988 E F0 3.322(,n)C .822(ormalised to be)-3.322 F F2 +410.4 R F24.988 E F0 3.322(,n)C .822(ormalised to be)-3.322 F F2 (tpm-tools)3.322 E F0 .823(-toolchain-compatible; if needed, it can)B -.866(be passed to)108 434.4 R F2 2.532(tpm2_unseal \255c)3.366 F F5 +.866(be passed to)108 422.4 R F2 2.532(tpm2_unseal \255c)3.366 F F5 (${tzpfms.key)6.866 E F2(%%)A F5(;)A/F6 10/Symbol SF(*)A F5(})A F0(with) 3.366 E F25.032 E F0(")6.866 E F5(str:${passphrase})A F0 3.365("o) -C(r)-3.365 E F2109.666 446.4 Q F0(")6.727 E F5(pcr:${tzpfms.key)A +C(r)-3.365 E F2109.666 434.4 Q F0(")6.727 E F5(pcr:${tzpfms.key)A F2(#)A F6(*)A F5(;})A F0 .727(", as the case may be, or equi)B -.25(va) -.25 G .728(lent, for back-up \(see).25 F F1(OPTIONS)3.228 E F0(\).)A -.448(If you ha)108 458.4 R .748 -.15(ve a s)-.2 H .448(ealed k).15 F +.448(If you ha)108 446.4 R .748 -.15(ve a s)-.2 H .448(ealed k).15 F .748 -.15(ey y)-.1 H .448(ou can access with that or equi).15 F -.25(va) -.25 G .447(lent tool and set both of these properties, it).25 F -(will funxion seamlessly)108 470.4 Q(.)-.65 E(Finally)108 487.2 Q 12.005 +(will funxion seamlessly)108 458.4 Q(.)-.65 E(Finally)108 475.2 Q 12.005 (,t)-.65 G 9.505(he equi)-12.005 F -.25(va)-.25 G 9.505(lent of).25 F F2 9.505(zfs change-key)12.005 F17.172 E F5(keylocation=prompt)15.506 -E F217.172 E F5(keyformat=raw)108 499.2 Q F3(dataset)6.107 E F0 +E F217.172 E F5(keyformat=raw)108 487.2 Q F3(dataset)6.107 E F0 .107(is performed with the ne)2.607 F 2.606(wk)-.25 G -.15(ey)-2.706 G 5.106(.I)-.5 G 2.606(fa)-5.106 G 2.606(ne)-2.606 G .106 (rror occurred, best ef)-2.606 F .106(fort is made)-.25 F .289(to clean\ up the persistent object and properties, or to issue a note for manual\ - interv)108 511.2 R .29(ention into the stan-)-.15 F(dard error stream.) -108 523.2 Q 2.625<418c>108 540 S .125(nal v)-2.625 F .125 + interv)108 499.2 R .29(ention into the stan-)-.15 F(dard error stream.) +108 511.2 Q 2.625<418c>108 528 S .125(nal v)-2.625 F .125 (eri\214cation should be made by running)-.15 F F2 1.79 (zfs-tpm2-load-key \255n)2.624 F F3(dataset)6.124 E F0 5.124(.I)C 2.624 (ft)-5.124 G .124(hat com-)-2.624 F .506(mand succeeds, all is well, b) -108 552 R .506(ut otherwise the dataset can be manually rolled back to \ -a passphrase with)-.2 F F2(zfs-tpm2-clear-key)108 564 Q F3(dataset) +108 540 R .506(ut otherwise the dataset can be manually rolled back to \ +a passphrase with)-.2 F F2(zfs-tpm2-clear-key)108 552 Q F3(dataset) 11.539 E F0(\(or)8.039 E 8.039(,i)-.4 G 8.039(ft)-8.039 G 5.539(hat f) -8.039 F 5.539(ails to w)-.1 F(ork,)-.1 E F2 5.539(zfs change-key)8.039 -F13.204 E F5(keyformat=passphrase)108 576 Q F3(dataset)6 E F0 +F13.204 E F5(keyformat=passphrase)108 564 Q F3(dataset)6 E F0 (\), and you are hereby ask)A(ed to report a b)-.1 E(ug, please.)-.2 E -F2(zfs-tpm2-clear-key)108 592.8 Q F3(dataset)6.029 E F0 .029 +F2(zfs-tpm2-clear-key)108 580.8 Q F3(dataset)6.029 E F0 .029 (can be used to free the TPM persistent object and go back to us-)2.529 -F(ing a passphrase.)108 604.8 Q F1(OPTIONS)72 621.6 Q F2109.666 -633.6 Q F3(backup-file)6 E F0(Sa)203 633.6 Q .353 -.15(ve a b)-.2 H .052 +F(ing a passphrase.)108 592.8 Q F1(OPTIONS)72 609.6 Q F2109.666 +621.6 Q F3(backup-file)6 E F0(Sa)203 621.6 Q .353 -.15(ve a b)-.2 H .052 (ack-up of the k).15 F .352 -.15(ey t)-.1 H(o).15 E F3(backup-file)2.552 E F0 2.552(,w)C .052(hich must not e)-2.552 F .052(xist beforehand.)-.15 -F .693(This back-up)203 645.6 R F4(must)3.193 E F0 .694 +F .693(This back-up)203 633.6 R F4(must)3.193 E F0 .694 (be stored securely)3.193 F 3.194(,o)-.65 G -.25(ff)-3.194 G 3.194 (-site. In).25 F .694(case of a catastrophic e)3.194 F -.15(ve)-.25 G -(nt,).15 E(the k)203 657.6 Q .3 -.15(ey c)-.1 H(an be loaded by running) -.15 E F2(zfs load-key)233 669.6 Q F3(dataset)6 E F5(<)6 E F3 -(backup-file)6 E F2109.666 686.4 Q F3(algorithm)6 E F2(:)A F3(PCR) +(nt,).15 E(the k)203 645.6 Q .3 -.15(ey c)-.1 H(an be loaded by running) +.15 E F2(zfs load-key)233 657.6 Q F3(dataset)6 E F5(<)6 E F3 +(backup-file)6 E F2109.666 674.4 Q F3(algorithm)6 E F2(:)A F3(PCR) A F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C([)-1.666 E F2(+)A F3(algorithm) A F2(:)A F3(PCR)A F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C 1.666(]...) --1.666 G 1.425(Bind the k)203 698.4 R 1.725 -.15(ey t)-.1 H 3.925(os).15 +-1.666 G 1.425(Bind the k)203 686.4 R 1.725 -.15(ey t)-.1 H 3.925(os).15 G 1.425(pace- or comma-separated)-3.925 F F3(PCR)3.924 E F0 3.924(sw)C -1.424(ithin their corresponding)-3.924 F(hashing)203 710.4 Q F3 +1.424(ithin their corresponding)-3.924 F(hashing)203 698.4 Q F3 (algorithm)2.523 E F0 2.523<8a69>2.523 G 2.523(ft)-2.523 G(he)-2.523 E 2.523(yc)-.15 G .023(hange, the wrapping k)-2.523 F .323 -.15(ey w)-.1 H -.024(ill not be able to be).15 F 2.5(unsealed. There)203 722.4 R(are)2.5 +.024(ill not be able to be).15 F 2.5(unsealed. There)203 710.4 R(are)2.5 E F1(24)2.5 E F0(PCRs, numbered [)2.5 E F1(0)A F0(,)A F1(23)2.5 E F0(].) -A F3(algorithm)203 739.2 Q F0 2.968(may be an)5.469 F 5.468(yo)-.15 G +A F3(algorithm)203 727.2 Q F0 2.968(may be an)5.469 F 5.468(yo)-.15 G 5.468(fc)-5.468 G(ase-insensiti)-5.468 E 3.268 -.15(ve ")-.25 H F1(sha1) .15 E F0 2.968(", ")B F1(sha256)A F0 2.968(", ")B F1(sha384)A F0(",)A(") -203 751.2 Q F1(sha512)A F0 4.983(", ")B F1(sm3_256)A F0 4.983(", ")B F1 +203 739.2 Q F1(sha512)A F0 4.983(", ")B F1(sm3_256)A F0 4.983(", ")B F1 (sm3-256)A F0 4.983(", ")B F1(sha3_256)A F0 4.983(", ")B F1(sha3-256)A -F0 4.983(", ")B F1(sha3_384)A F0(",)A(")203 763.2 Q F1(sha3-384)A F0 +F0 4.983(", ")B F1(sha3_384)A F0(",)A(")203 751.2 Q F1(sha3-384)A F0 (", ")A F1(sha3_512)A F0(", or ")A F1(sha3-512)A F0 -(", and must be supported by the TPM.)A(tzpfms 0.3.4-34-g48bebe9)72 -817.889 Q(March 11, 2024)88.578 E(1)188.837 E 0 Cg EP -%%Page: 2 13 +(", and must be supported by the TPM.)A(tzpfms 0.4.0)72 817.889 Q +(March 11, 2024)144.118 E(1)188.837 E 0 Cg EP +%%Page: 2 8 %%BeginPageSetup BP %%EndPageSetup @@ -1233,9 +843,9 @@ E F3 1.666(SEE ALSO)72 616.8 R F4(tpm2_unseal)108 628.8 Q F0(\(1\))A (and https://trustedcomputinggroup.or)108 657.6 Q (g/wp-content/uploads/PC-)-.18 E(ClientSpeci\214c_Platform_Pro\214le_fo\ r_TPM_2p0_Systems_v51.pdf, Section 2.3.4 "PCR Usage", T)108 669.6 Q -(able)-.8 E(1.)108 681.6 Q(tzpfms 0.3.4-34-g48bebe9)72 817.889 Q -(March 11, 2024)88.578 E(2)188.837 E 0 Cg EP -%%Page: 1 14 +(able)-.8 E(1.)108 681.6 Q(tzpfms 0.4.0)72 817.889 Q(March 11, 2024) +144.118 E(2)188.837 E 0 Cg EP +%%Page: 1 9 %%BeginPageSetup BP %%EndPageSetup @@ -1245,8 +855,8 @@ F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF (zfs-tpm2-clear-key)108 96 Q F0 2.5<8a72>2.5 G -.25(ew)-2.5 G (rap ZFS dataset k).25 E .3 -.15(ey i)-.1 H 2.5(np).15 G(asssw)-2.5 E (ord and clear tzpfms TPM2 metadata)-.1 E F1(SYNOPSIS)72 112.8 Q F2 -(zfs-fido2-add-backup)108 124.8 Q/F3 10/Courier-Oblique@0 SF(dataset)2.5 -E F1(DESCRIPTION)72 141.6 Q F0(After v)108 153.6 Q(erifying)-.15 E F3 +(zfs-tpm-list)108 124.8 Q/F3 10/Courier-Oblique@0 SF(dataset)2.5 E F1 +(DESCRIPTION)72 141.6 Q F0(After v)108 153.6 Q(erifying)-.15 E F3 (dataset)2.5 E F0 -.1(wa)2.5 G 2.5(se).1 G(ncrypted with the)-2.5 E F2 (tzpfms)2.5 E F1(TPM2)2.5 E F0(back)2.5 E(end:)-.1 E 5(1. performs)118 165.6 R 5.641(the equi)8.141 F -.25(va)-.25 G 5.641(lent of).25 F F2 @@ -1313,9 +923,9 @@ F(UGS)-.1 E F0(https://todo.sr)108 681.6 Q(.ht/\001nabijaczle)-.55 E (weli/tzpfms)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 698.4 Q F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E (https://lists.sr)108 710.4 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.) --.25 E(tzpfms 0.3.4-34-g48bebe9)72 817.889 Q(March 11, 2024)88.578 E(1) -188.837 E 0 Cg EP -%%Page: 1 15 +-.25 E(tzpfms 0.4.0)72 817.889 Q(March 11, 2024)144.118 E(1)188.837 E 0 +Cg EP +%%Page: 1 10 %%BeginPageSetup BP %%EndPageSetup @@ -1324,28 +934,27 @@ BP (AD-KEY\(8\))-.35 E/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10 /Courier-Bold@0 SF(zfs-tpm2-load-key)108 96 Q F0 2.5<8a6c>2.5 G (oad TPM2-encrypted ZFS dataset k)-2.5 E -.15(ey)-.1 G F1(SYNOPSIS)72 -112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([)2.5 E F21.666 E -F0(])A/F3 10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 -Q F0 .388(After v)108 153.6 R(erifying)-.15 E F3(dataset)2.889 E F0 -.1 -(wa)2.889 G 2.889(se).1 G .389(ncrypted with the)-2.889 F F2(tzpfms) -2.889 E F1(TPM2)2.889 E F0(back)2.889 E .389(end, unseals the k)-.1 F -.689 -.15(ey a)-.1 H .389(nd loads).15 F(it into)108 165.6 Q F3(dataset) -2.5 E F0(.)A(The user is prompted for the additional passphrase, set wh\ -en creating the k)108 182.4 Q -.15(ey)-.1 G 2.5(,i)-.5 G 2.5(fo)-2.5 G -(ne w)-2.5 E(as set.)-.1 E(See)108 199.2 Q/F4 10/Courier@0 SF -(zfs-tpm2-change-key)2.5 E F0(\(8\) for a detailed description.)A F1 -(OPTIONS)72 216 Q F2109.666 228 Q F0 3.208 -(Do a no-op/dry run, can be used e)131 228 R -.15(ve)-.25 G 5.708(ni).15 -G 5.708(ft)-5.708 G 3.208(he k)-5.708 F 3.508 -.15(ey i)-.1 H 5.708(sa) -.15 G 3.208(lready loaded.)-5.708 F(Equi)8.207 E -.25(va)-.25 G 3.207 -(lent to).25 F F2(zfs)5.707 E(load-key)131 240 Q F0 -.55('s)C F2 -4.716 E F0(option.)2.5 E F1(ENVIR)72 256.8 Q 1.666(ONMENT V)-.3 F -(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 268.8 Q F0 .045 -(By def)133 280.8 R .045(ault, passphrases are prompted for and read in\ - on the standard output and input streams.)-.1 F(If)5.046 E F4 -(TZPFMS_PASSPHRASE_HELPER)133 292.8 Q F0 1.596(is set and nonempty)4.096 -F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F4 -(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 304.8 Q +112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F21.666 E F0(])A/F3 +10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 .388 +(After v)108 153.6 R(erifying)-.15 E F3(dataset)2.889 E F0 -.1(wa)2.889 +G 2.889(se).1 G .389(ncrypted with the)-2.889 F F2(tzpfms)2.889 E F1 +(TPM2)2.889 E F0(back)2.889 E .389(end, unseals the k)-.1 F .689 -.15 +(ey a)-.1 H .389(nd loads).15 F(it into)108 165.6 Q F3(dataset)2.5 E F0 +(.)A(The user is prompted for the additional passphrase, set when creat\ +ing the k)108 182.4 Q -.15(ey)-.1 G 2.5(,i)-.5 G 2.5(fo)-2.5 G(ne w)-2.5 +E(as set.)-.1 E(See)108 199.2 Q/F4 10/Courier@0 SF(zfs-tpm2-change-key) +2.5 E F0(\(8\) for a detailed description.)A F1(OPTIONS)72 216 Q F2 +109.666 228 Q F0 3.208(Do a no-op/dry run, can be used e)131 228 R +-.15(ve)-.25 G 5.708(ni).15 G 5.708(ft)-5.708 G 3.208(he k)-5.708 F +3.508 -.15(ey i)-.1 H 5.708(sa).15 G 3.208(lready loaded.)-5.708 F(Equi) +8.207 E -.25(va)-.25 G 3.207(lent to).25 F F2(zfs)5.707 E(load-key)131 +240 Q F0 -.55('s)C F24.716 E F0(option.)2.5 E F1(ENVIR)72 256.8 Q +1.666(ONMENT V)-.3 F(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 +268.8 Q F0 .045(By def)133 280.8 R .045(ault, passphrases are prompted \ +for and read in on the standard output and input streams.)-.1 F(If)5.046 +E F4(TZPFMS_PASSPHRASE_HELPER)133 292.8 Q F0 1.596(is set and nonempty) +4.096 F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F +F4(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 304.8 Q (vide each passphrase, instead.)-.15 E .643 (The standard output stream of the helper is tied to an anon)133 321.6 R .643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) @@ -1391,8 +1000,7 @@ F(UGS)-.1 E F0(https://todo.sr)108 655.2 Q(.ht/\001nabijaczle)-.55 E (weli/tzpfms)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 672 Q F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E (https://lists.sr)108 684 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 -E(tzpfms 0.3.4-34-g48bebe9)72 817.889 Q(March 11, 2024)88.578 E(1) -188.837 E 0 Cg EP +E(tzpfms 0.4.0)72 817.889 Q(March 11, 2024)144.118 E(1)188.837 E 0 Cg EP %%Trailer end %%EOF diff --git a/zfs-fido2-add-backup.8 b/zfs-fido2-add-backup.8 deleted file mode 100644 index 0121b13..0000000 --- a/zfs-fido2-add-backup.8 +++ /dev/null @@ -1,123 +0,0 @@ -.\" SPDX-License-Identifier: MIT -. -.Dd March 11, 2024 -.ds doc-volume-operating-system -.Dt ZFS-FIDO2-ADD-BACKUP 8 -.Os fzifdso 0.4.0 -. -.Sh NAME -.Nm zfs-fido2-add-backup -.Nd allow another FIDO2 device to unlock ZFS dataset -.Sh SYNOPSIS -.Nm -.Ar dataset -. -.Sh DESCRIPTION -After -.Xr zfs-fido2-change-key 8 -derives the key for a dataset from a FIDO2 device, -.Nm -may be executed to extend this to any number of additional devices. -.Pp -First, the wrapping key is extracted as normally during -.Xr zfs-fido2-load-key 8 , -then a credential is made as-if during -.Xr zfs-fido2-change-key 8 -(except the "primary" device and all the ones holding backups are excluded from the search); -however, the -.Ql hmac-secret -is instead used as a symmetric AES-256-GCM -.Pq Xr EVP_CIPHER-AES 7ssl -key to encrypt the wrapping key directly with a random IV. -.Pp -This turns the -.Li xyz.nabijaczleweli:tzpfms.key -variable into a dot-separated list of device bundles: -.Bd -ragged -compact -offset 2n -.Ar salt Ns Cm :\:\& Ns Ar credential-ID Ns Cm :\:\& Ns Ar credential-public-key Ns Oo Cm \&. Ns Ar backup-salt Ns Cm :\:\& Ns Ar backup-credential-ID Ns Cm :\:\& Ns Ar backup-credential-public-key Ns Cm :\:\& Ns Ar IV Ns Cm :\:\& Ns Ar encrypted-key Oc Ns … -.Ed -The first one is as-described in -.Xr zfs-fido2-change-key 8 . -Subsequent ones also include (identically-encoded) IVs and encrypted blobs. -.Pp -.Xr zfs-fido2-load-key 8 -shops assertions around devices in a device-major order \(em -depending on device numbering, a backup may be loaded even if the primary device is present. -. -.\" SPDX-License-Identifier: MIT -. -.Sh ENVIRONMENT VARIABLES -.Bl -tag -compact -width 4n -.It Ev TZPFMS_PASSPHRASE_HELPER -By default, passphrases are prompted for and read in on the standard output and input streams. -If -.Ev TZPFMS_PASSPHRASE_HELPER -is set and nonempty, it will be run via -.Pa /bin/ Ns Nm sh Fl c -to provide each passphrase, instead. -.Pp -The standard output stream of the helper is tied to an anonymous file and used in its entirety as the passphrase, except for a trailing new-line, if any. -The arguments are: -.Bl -tag -compact -offset 2n -width ".Li $1" -.It Li $1 -Pre-formatted noun phrase with all the information below, for use as a prompt -.\" Passphrase for tarta-zoot -.\" New passphrase for tarta-zoot (again) -.It Li $2 -Either the dataset name or the device feature being prompted for -.It Li $3 -.Qq new -if this is for a new passphrase, otherwise blank -.It Li $4 -.Qq again -if it's the second prompt for that passphrase, otherwise blank -.El -.Pp -If the helper doesn't exist -.Pq the shell exits with Sy 127 , -a diagnostic is issued and the normal prompt is used as fall-back. -If it fails for any other reason, the prompting is aborted. -. -. -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh FIDO2 back-end configuration -.Ss Environment variables -.Bl -tag -compact -width ".Ev FIDO_DEBUG" -.It Ev FIDO_DEBUG -If set, enables libfido2 debug logging to the standard error stream. -.El -. -.Ss Device selection -When creating, the first device which supports the -.Ql hmac-secret -extension is used. -When loading, the assertion yielding the key is shopped around to every such device. -. -.Ss See also -The libfido2 documentation at -.Lk https:/\&/developers.yubico.com/libfido2/ . -. -.\" SPDX-License-Identifier: MIT -. -.Sh SPECIAL THANKS -To all who support further development, in particular: -.Bl -bullet -offset 4n -compact -width "@" -.It -ThePhD -.It -Embark Studios -.It -Jasper Bekkers -.It -EvModder -.El -. -.Sh REPORTING BUGS -.Lk https:/\&/todo.sr.ht/\(tinabijaczleweli/fzifdso -.Pp -.Mt \(tinabijaczleweli/tzpfms@lists.sr.ht , -archived at -.Lk https:/\&/lists.sr.ht/\(tinabijaczleweli/tzpfms . diff --git a/zfs-fido2-add-backup.8.html b/zfs-fido2-add-backup.8.html deleted file mode 100644 index 48af0cd..0000000 --- a/zfs-fido2-add-backup.8.html +++ /dev/null @@ -1,152 +0,0 @@ - - - - - - - - ZFS-FIDO2-ADD-BACKUP(8) - - - - - - - - -
ZFS-FIDO2-ADD-BACKUP(8)System Manager's ManualZFS-FIDO2-ADD-BACKUP(8)
-
-
-

-

zfs-fido2-add-backup — - allow another FIDO2 device to unlock ZFS dataset

-
-
-

- - - - - -
zfs-fido2-add-backupdataset
-
-
-

-

After - zfs-fido2-change-key(8) - derives the key for a dataset from a FIDO2 device, - zfs-fido2-add-backup may be executed to extend this - to any number of additional devices.

-

First, the wrapping key is extracted as normally during - zfs-fido2-load-key(8), - then a credential is made as-if during - zfs-fido2-change-key(8) - (except the "primary" device and all the ones holding backups are - excluded from the search); however, the - ‘hmac-secret’ is instead used as a - symmetric AES-256-GCM - (EVP_CIPHER-AES(7ssl)) - key to encrypt the wrapping key directly with a random IV.

-

This turns the - xyz.nabijaczleweli:tzpfms.key variable into a - dot-separated list of device bundles:

-
salt:credential-ID:credential-public-key[.backup-salt:backup-credential-ID:backup-credential-public-key:IV:encrypted-key]…
-The first one is as-described in - zfs-fido2-change-key(8). - Subsequent ones also include (identically-encoded) IVs and encrypted blobs. -

zfs-fido2-load-key(8) - shops assertions around devices in a device-major order — depending - on device numbering, a backup may be loaded even if the primary device is - present.

-
-
-

-
-
-
By default, passphrases are prompted for and read in on the standard - output and input streams. If - TZPFMS_PASSPHRASE_HELPER is set and nonempty, it - will be run via /bin/sh - -c to provide each passphrase, instead. -

The standard output stream of the helper is tied to an - anonymous file and used in its entirety as the passphrase, except for a - trailing new-line, if any. The arguments are:

-
-
-
-
Pre-formatted noun phrase with all the information below, for use as a - prompt
-
-
Either the dataset name or the device feature being prompted for
-
-
"new" if this is for a new passphrase, otherwise blank
-
-
"again" if it's the second prompt for that passphrase, - otherwise blank
-
-
-

If the helper doesn't exist (the shell exits with - ), a - diagnostic is issued and the normal prompt is used as fall-back. If it - fails for any other reason, the prompting is aborted.

-
-
-
-
-

-
-

-
-
-
If set, enables libfido2 debug logging to the standard error stream.
-
-
-
-

-

When creating, the first device which supports the - ‘hmac-secret’ extension is used. When - loading, the assertion yielding the key is shopped around to every such - device.

-
-
-

-

The libfido2 documentation at - https://developers.yubico.com/libfido2/.

-
-
-
-

-

To all who support further development, in particular:

-
    -
  • ThePhD
    • -
  • Embark Studios
    • -
  • Jasper Bekkers
    • -
  • EvModder
    • -
-
-
-

-

https://todo.sr.ht/~nabijaczleweli/fzifdso

-

~nabijaczleweli/tzpfms@lists.sr.ht, - archived at - https://lists.sr.ht/~nabijaczleweli/tzpfms.

-
-
- - - - - -
March 11, 2024fzifdso 0.4.0
- - diff --git a/zfs-fido2-change-key.8 b/zfs-fido2-change-key.8 deleted file mode 100644 index 86dd81c..0000000 --- a/zfs-fido2-change-key.8 +++ /dev/null @@ -1,188 +0,0 @@ -.\" SPDX-License-Identifier: MIT -. -.Dd March 4, 2024 -.ds doc-volume-operating-system -.Dt ZFS-FIDO2-CHANGE-KEY 8 -.Os fzifdso 0.4.0 -. -.Sh NAME -.Nm zfs-fido2-change-key -.Nd change ZFS dataset key to one authenticated by a FIDO2 device -.Sh SYNOPSIS -.Nm -.Op Fl b Ar backup-file -.Ar dataset -. -.Sh DESCRIPTION -To normalise the -.Ar dataset , -.Nm -will open its encryption root in its stead. -.Nm -will -.Em never -create or destroy encryption roots; use -.Xr zfs-change-key 8 -for that. -.Pp -First, a connection is made to the FIDO2 device, which -.Em must -support the -.Ql hmac-secret -extension. -.Pp -If -.Ar dataset -was previously encrypted with -.Nm fzifdso -and the -.Sy FIDO2 -back-end was used, previous credentials will be deleted from their devices (as-if via -.Xr zfs-fido2-clear-key 8 ) , -if available. -Otherwise, or in case of an error, data required for manual intervention will be written to the standard error stream. -.Pp -Next, a new credential of type ES256 is generated on the device (with relying party ID -.Li fzifdso -and name equal to the dataset name) -with the -.Ql hmac-secret -extension requested; the device PIN, if any, is prompted for here. -This mimicks a WebAuthn registration step. -.Pp -Then, the credential is asserted with a 32-byte random salt, -which hashes it with device-private data, and thus generates the wrapping key -.Pq which is optionally backed up Pq see Sx OPTIONS . -This mimicks a WebAuthn login step. -.Pp -The following properties are set on -.Ar dataset : -.Bl -bullet -compact -offset 4n -width "@" -.It -.Li xyz.nabijaczleweli:tzpfms.backend Ns = Ns Sy FIDO2 -.It -.Li xyz.nabijaczleweli:tzpfms.key Ns = Ns Ar salt Ns Cm :\:\& Ns Ar credential-ID Ns Cm :\:\& Ns Ar credential-public-key Ns Oo Cm \&. Ns … Oc Ns … -.El -.Pp -.Li tzpfms.backend -identifies this dataset for work with -.Sy FIDO2 Ns -back-ended -.Nm tzpfms -tools -.Pq i.e. Nm fzifdso Xr zfs-fido2-change-key 8 , Xr zfs-fido2-load-key 8 , Xr zfs-fido2-add-backup 8 , and Xr zfs-fido2-clear-key 8 . -.Pp -.Li tzpfms.key -is a colon-separated tuple of unpadded URL-safe base64 blobs; -the first one is the random salt; -the second represents the ID of created credential, -and the third \(en its public key. -There exists no other user-land tool for deciphering this; perhaps there should be. -.\"" TODO: make an LD_PRELOADable for extracting the key maybe? -.Pp -Finally, the equivalent of -.Nm zfs Cm change-key Fl o Li keylocation=prompt Fl o Li keyformat=raw Ar dataset -is performed with the new key. -If an error occurred, best effort is made to clean up the properties, -or to issue a note for manual intervention into the standard error stream. -.Pp -A final verification should be made by running -.Nm zfs-fido2-load-key Fl n Ar dataset . -If that command succeeds, all is well, -but otherwise the dataset can be manually rolled back to a passphrase with -.Nm zfs-fido2-clear-key Ar dataset -.Pq or, if that fails to work, Nm zfs Cm change-key Fl o Li keyformat=passphrase Ar dataset , -and you are hereby asked to report a bug, please. -.Pp -.Nm zfs-fido2-clear-key Ar dataset -can be used to clear the properties and go back to using a passphrase. -. -.Sh OPTIONS -.Bl -tag -compact -width ".Fl b Ar backup-file" -.It Fl b Ar backup-file -Save a back-up of the key to -.Ar backup-file , -which must not exist beforehand. -This back-up -.Em must -be stored securely, off-site. -In case of a catastrophic event, the key can be loaded by running -.Dl Nm zfs Cm load-key Ar dataset Li < Ar backup-file -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh ENVIRONMENT VARIABLES -.Bl -tag -compact -width 4n -.It Ev TZPFMS_PASSPHRASE_HELPER -By default, passphrases are prompted for and read in on the standard output and input streams. -If -.Ev TZPFMS_PASSPHRASE_HELPER -is set and nonempty, it will be run via -.Pa /bin/ Ns Nm sh Fl c -to provide each passphrase, instead. -.Pp -The standard output stream of the helper is tied to an anonymous file and used in its entirety as the passphrase, except for a trailing new-line, if any. -The arguments are: -.Bl -tag -compact -offset 2n -width ".Li $1" -.It Li $1 -Pre-formatted noun phrase with all the information below, for use as a prompt -.\" Passphrase for tarta-zoot -.\" New passphrase for tarta-zoot (again) -.It Li $2 -Either the dataset name or the device feature being prompted for -.It Li $3 -.Qq new -if this is for a new passphrase, otherwise blank -.It Li $4 -.Qq again -if it's the second prompt for that passphrase, otherwise blank -.El -.Pp -If the helper doesn't exist -.Pq the shell exits with Sy 127 , -a diagnostic is issued and the normal prompt is used as fall-back. -If it fails for any other reason, the prompting is aborted. -. -. -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh FIDO2 back-end configuration -.Ss Environment variables -.Bl -tag -compact -width ".Ev FIDO_DEBUG" -.It Ev FIDO_DEBUG -If set, enables libfido2 debug logging to the standard error stream. -.El -. -.Ss Device selection -When creating, the first device which supports the -.Ql hmac-secret -extension is used. -When loading, the assertion yielding the key is shopped around to every such device. -. -.Ss See also -The libfido2 documentation at -.Lk https:/\&/developers.yubico.com/libfido2/ . -. -.\" SPDX-License-Identifier: MIT -. -.Sh SPECIAL THANKS -To all who support further development, in particular: -.Bl -bullet -offset 4n -compact -width "@" -.It -ThePhD -.It -Embark Studios -.It -Jasper Bekkers -.It -EvModder -.El -. -.Sh REPORTING BUGS -.Lk https:/\&/todo.sr.ht/\(tinabijaczleweli/fzifdso -.Pp -.Mt \(tinabijaczleweli/tzpfms@lists.sr.ht , -archived at -.Lk https:/\&/lists.sr.ht/\(tinabijaczleweli/tzpfms . diff --git a/zfs-fido2-change-key.8.html b/zfs-fido2-change-key.8.html deleted file mode 100644 index f2bde4b..0000000 --- a/zfs-fido2-change-key.8.html +++ /dev/null @@ -1,207 +0,0 @@ - - - - - - - - ZFS-FIDO2-CHANGE-KEY(8) - - - - - - - - -
ZFS-FIDO2-CHANGE-KEY(8)System Manager's ManualZFS-FIDO2-CHANGE-KEY(8)
-
-
-

-

zfs-fido2-change-key — - change ZFS dataset key to one authenticated by a FIDO2 - device

-
-
-

- - - - - -
zfs-fido2-change-key[-b backup-file] - dataset
-
-
-

-

To normalise the dataset, - zfs-fido2-change-key will open its encryption root - in its stead. zfs-fido2-change-key will - - create or destroy encryption roots; use - zfs-change-key(8) - for that.

-

First, a connection is made to the FIDO2 device, which - must support the - ‘hmac-secret’ extension.

-

If dataset was previously encrypted with - fzifdso and the FIDO2 back-end was - used, previous credentials will be deleted from their devices (as-if via - zfs-fido2-clear-key(8)), - if available. Otherwise, or in case of an error, data required for manual - intervention will be written to the standard error stream.

-

Next, a new credential of type ES256 is generated on the device - (with relying party ID fzifdso and name equal to the - dataset name) with the ‘hmac-secret’ - extension requested; the device PIN, if any, is prompted for here. This - mimicks a WebAuthn registration step.

-

Then, the credential is asserted with a 32-byte random salt, which - hashes it with device-private data, and thus generates the wrapping key - (which is optionally backed up (see - OPTIONS)). This mimicks a WebAuthn login - step.

-

The following properties are set on - dataset:

- -

tzpfms.backend identifies this dataset for - work with FIDO2-back-ended tzpfms - tools (i.e. fzifdso - zfs-fido2-change-key(8), - zfs-fido2-load-key(8), - zfs-fido2-add-backup(8), - and - zfs-fido2-clear-key(8)).

-

tzpfms.key is a colon-separated tuple of - unpadded URL-safe base64 blobs; the first one is the random salt; the second - represents the ID of created credential, and the third – its public - key. There exists no other user-land tool for deciphering this; perhaps - there should be.

-

Finally, the equivalent of zfs - change-key -o - keylocation=prompt -o - keyformat=raw dataset is - performed with the new key. If an error occurred, best effort is made to - clean up the properties, or to issue a note for manual intervention into the - standard error stream.

-

A final verification should be made by running - zfs-fido2-load-key -n - dataset. If that command succeeds, all is well, but - otherwise the dataset can be manually rolled back to a passphrase with - zfs-fido2-clear-key dataset - (or, if that fails to work, zfs - change-key -o - keyformat=passphrase dataset), - and you are hereby asked to report a bug, please.

-

zfs-fido2-clear-key - dataset can be used to clear the properties and go - back to using a passphrase.

-
-
-

-
-
- backup-file
-
Save a back-up of the key to backup-file, which must - not exist beforehand. This back-up must be stored - securely, off-site. In case of a catastrophic event, the key can be loaded - by running -
zfs - load-key dataset - < - backup-file
-
-
-
-
-

-
-
-
By default, passphrases are prompted for and read in on the standard - output and input streams. If - TZPFMS_PASSPHRASE_HELPER is set and nonempty, it - will be run via /bin/sh - -c to provide each passphrase, instead. -

The standard output stream of the helper is tied to an - anonymous file and used in its entirety as the passphrase, except for a - trailing new-line, if any. The arguments are:

-
-
-
-
Pre-formatted noun phrase with all the information below, for use as a - prompt
-
-
Either the dataset name or the device feature being prompted for
-
-
"new" if this is for a new passphrase, otherwise blank
-
-
"again" if it's the second prompt for that passphrase, - otherwise blank
-
-
-

If the helper doesn't exist (the shell exits with - ), a - diagnostic is issued and the normal prompt is used as fall-back. If it - fails for any other reason, the prompting is aborted.

-
-
-
-
-

-
-

-
-
-
If set, enables libfido2 debug logging to the standard error stream.
-
-
-
-

-

When creating, the first device which supports the - ‘hmac-secret’ extension is used. When - loading, the assertion yielding the key is shopped around to every such - device.

-
-
-

-

The libfido2 documentation at - https://developers.yubico.com/libfido2/.

-
-
-
-

-

To all who support further development, in particular:

-
    -
  • ThePhD
    • -
  • Embark Studios
    • -
  • Jasper Bekkers
    • -
  • EvModder
    • -
-
-
-

-

https://todo.sr.ht/~nabijaczleweli/fzifdso

-

~nabijaczleweli/tzpfms@lists.sr.ht, - archived at - https://lists.sr.ht/~nabijaczleweli/tzpfms.

-
-
- - - - - -
March 4, 2024fzifdso 0.4.0
- - diff --git a/zfs-fido2-clear-key.8 b/zfs-fido2-clear-key.8 deleted file mode 100644 index 2db26c4..0000000 --- a/zfs-fido2-clear-key.8 +++ /dev/null @@ -1,121 +0,0 @@ -.\" SPDX-License-Identifier: MIT -. -.Dd March 11, 2024 -.ds doc-volume-operating-system -.Dt ZFS-FIDO2-CLEAR-KEY 8 -.Os fzifdso 0.4.0 -. -.Sh NAME -.Nm zfs-fido2-clear-key -.Nd rewrap ZFS dataset key in passsword and clear tzpfms FIDO2 metadata -.Sh SYNOPSIS -.Nm -.Ar dataset -. -.Sh DESCRIPTION -After verifying -.Ar dataset -was encrypted with the -.Nm tzpfms -.Sy FIDO2 -backend: -.Bl -enum -compact -offset 2n -width 2n -.It -performs the equivalent of -.Nm zfs Cm change-key Fl o Li keylocation=prompt Fl o Li keyformat=passphrase Ar dataset , -.It -loads the primary and every backup credential, and for each success, if the device containing it supports the -.Ql credMgmt \" or credentialMgmtPreview -feature and has a PIN set, tries to delete the credential from the device, -.It -removes the -.Li xyz.nabijaczleweli:tzpfms.\& Ns Brq Li backend , key -properties from -.Ar dataset . -.El -.Pp -For every removal failure and missing device or PIN an instruction for manual removal with -.Xr fido2-token 1 -is issued. -.Pp -See -.Xr zfs-fido2-change-key 8 -for a detailed description. -. -.\" SPDX-License-Identifier: MIT -. -.Sh ENVIRONMENT VARIABLES -.Bl -tag -compact -width 4n -.It Ev TZPFMS_PASSPHRASE_HELPER -By default, passphrases are prompted for and read in on the standard output and input streams. -If -.Ev TZPFMS_PASSPHRASE_HELPER -is set and nonempty, it will be run via -.Pa /bin/ Ns Nm sh Fl c -to provide each passphrase, instead. -.Pp -The standard output stream of the helper is tied to an anonymous file and used in its entirety as the passphrase, except for a trailing new-line, if any. -The arguments are: -.Bl -tag -compact -offset 2n -width ".Li $1" -.It Li $1 -Pre-formatted noun phrase with all the information below, for use as a prompt -.\" Passphrase for tarta-zoot -.\" New passphrase for tarta-zoot (again) -.It Li $2 -Either the dataset name or the device feature being prompted for -.It Li $3 -.Qq new -if this is for a new passphrase, otherwise blank -.It Li $4 -.Qq again -if it's the second prompt for that passphrase, otherwise blank -.El -.Pp -If the helper doesn't exist -.Pq the shell exits with Sy 127 , -a diagnostic is issued and the normal prompt is used as fall-back. -If it fails for any other reason, the prompting is aborted. -. -. -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh FIDO2 back-end configuration -.Ss Environment variables -.Bl -tag -compact -width ".Ev FIDO_DEBUG" -.It Ev FIDO_DEBUG -If set, enables libfido2 debug logging to the standard error stream. -.El -. -.Ss Device selection -When creating, the first device which supports the -.Ql hmac-secret -extension is used. -When loading, the assertion yielding the key is shopped around to every such device. -. -.Ss See also -The libfido2 documentation at -.Lk https:/\&/developers.yubico.com/libfido2/ . -. -.\" SPDX-License-Identifier: MIT -. -.Sh SPECIAL THANKS -To all who support further development, in particular: -.Bl -bullet -offset 4n -compact -width "@" -.It -ThePhD -.It -Embark Studios -.It -Jasper Bekkers -.It -EvModder -.El -. -.Sh REPORTING BUGS -.Lk https:/\&/todo.sr.ht/\(tinabijaczleweli/fzifdso -.Pp -.Mt \(tinabijaczleweli/tzpfms@lists.sr.ht , -archived at -.Lk https:/\&/lists.sr.ht/\(tinabijaczleweli/tzpfms . diff --git a/zfs-fido2-clear-key.8.html b/zfs-fido2-clear-key.8.html deleted file mode 100644 index 939f9ca..0000000 --- a/zfs-fido2-clear-key.8.html +++ /dev/null @@ -1,152 +0,0 @@ - - - - - - - - ZFS-FIDO2-CLEAR-KEY(8) - - - - - - - - -
ZFS-FIDO2-CLEAR-KEY(8)System Manager's ManualZFS-FIDO2-CLEAR-KEY(8)
-
-
-

-

zfs-fido2-clear-key — - rewrap ZFS dataset key in passsword and clear tzpfms FIDO2 - metadata

-
-
-

- - - - - -
zfs-fido2-clear-keydataset
-
-
-

-

After verifying dataset was encrypted with - the tzpfms - - backend:

-
    -
  1. performs the equivalent of zfs - change-key -o - keylocation=prompt -o - keyformat=passphrase - dataset,
    2. -
  2. loads the primary and every backup credential, and for each success, if - the device containing it supports the - ‘credMgmt’ feature and has a PIN - set, tries to delete the credential from the device,
    3. -
  3. removes the - xyz.nabijaczleweli:tzpfms.{backend, - key} properties from - dataset.
    4. -
-

For every removal failure and missing device or PIN an instruction - for manual removal with - fido2-token(1) - is issued.

-

See - zfs-fido2-change-key(8) - for a detailed description.

-
-
-

-
-
-
By default, passphrases are prompted for and read in on the standard - output and input streams. If - TZPFMS_PASSPHRASE_HELPER is set and nonempty, it - will be run via /bin/sh - -c to provide each passphrase, instead. -

The standard output stream of the helper is tied to an - anonymous file and used in its entirety as the passphrase, except for a - trailing new-line, if any. The arguments are:

-
-
-
-
Pre-formatted noun phrase with all the information below, for use as a - prompt
-
-
Either the dataset name or the device feature being prompted for
-
-
"new" if this is for a new passphrase, otherwise blank
-
-
"again" if it's the second prompt for that passphrase, - otherwise blank
-
-
-

If the helper doesn't exist (the shell exits with - ), a - diagnostic is issued and the normal prompt is used as fall-back. If it - fails for any other reason, the prompting is aborted.

-
-
-
-
-

-
-

-
-
-
If set, enables libfido2 debug logging to the standard error stream.
-
-
-
-

-

When creating, the first device which supports the - ‘hmac-secret’ extension is used. When - loading, the assertion yielding the key is shopped around to every such - device.

-
-
-

-

The libfido2 documentation at - https://developers.yubico.com/libfido2/.

-
-
-
-

-

To all who support further development, in particular:

-
    -
  • ThePhD
    • -
  • Embark Studios
    • -
  • Jasper Bekkers
    • -
  • EvModder
    • -
-
-
-

-

https://todo.sr.ht/~nabijaczleweli/fzifdso

-

~nabijaczleweli/tzpfms@lists.sr.ht, - archived at - https://lists.sr.ht/~nabijaczleweli/tzpfms.

-
-
- - - - - -
March 11, 2024fzifdso 0.4.0
- - diff --git a/zfs-fido2-load-key.8 b/zfs-fido2-load-key.8 deleted file mode 100644 index e2896df..0000000 --- a/zfs-fido2-load-key.8 +++ /dev/null @@ -1,116 +0,0 @@ -.\" SPDX-License-Identifier: MIT -. -.Dd March 11, 2024 -.ds doc-volume-operating-system -.Dt ZFS-FIDO2-LOAD-KEY 8 -.Os fzifdso 0.4.0 -. -.Sh NAME -.Nm zfs-fido2-load-key -.Nd load FIDO2-encrypted ZFS dataset key -.Sh SYNOPSIS -.Nm -.Op Fl n -.Ar dataset -. -.Sh DESCRIPTION -After verifying -.Ar dataset -was encrypted with the -.Nm tzpfms -.Sy FIDO2 -backend, -asserts the preserved challenge, HMACking the salt with the on-device secret, and loads the resulting key into -.Ar dataset . -.Pp -See -.Xr zfs-fido2-change-key 8 -for a detailed description. -. -.Sh OPTIONS -.Bl -tag -compact -width ".Fl n" -.It Fl n -Do a no-op/dry run, can be used even if the key is already loaded. -Equivalent to -.Nm zfs Cm load-key Ns 's -.Fl n -option. -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh ENVIRONMENT VARIABLES -.Bl -tag -compact -width 4n -.It Ev TZPFMS_PASSPHRASE_HELPER -By default, passphrases are prompted for and read in on the standard output and input streams. -If -.Ev TZPFMS_PASSPHRASE_HELPER -is set and nonempty, it will be run via -.Pa /bin/ Ns Nm sh Fl c -to provide each passphrase, instead. -.Pp -The standard output stream of the helper is tied to an anonymous file and used in its entirety as the passphrase, except for a trailing new-line, if any. -The arguments are: -.Bl -tag -compact -offset 2n -width ".Li $1" -.It Li $1 -Pre-formatted noun phrase with all the information below, for use as a prompt -.\" Passphrase for tarta-zoot -.\" New passphrase for tarta-zoot (again) -.It Li $2 -Either the dataset name or the device feature being prompted for -.It Li $3 -.Qq new -if this is for a new passphrase, otherwise blank -.It Li $4 -.Qq again -if it's the second prompt for that passphrase, otherwise blank -.El -.Pp -If the helper doesn't exist -.Pq the shell exits with Sy 127 , -a diagnostic is issued and the normal prompt is used as fall-back. -If it fails for any other reason, the prompting is aborted. -. -. -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh FIDO2 back-end configuration -.Ss Environment variables -.Bl -tag -compact -width ".Ev FIDO_DEBUG" -.It Ev FIDO_DEBUG -If set, enables libfido2 debug logging to the standard error stream. -.El -. -.Ss Device selection -When creating, the first device which supports the -.Ql hmac-secret -extension is used. -When loading, the assertion yielding the key is shopped around to every such device. -. -.Ss See also -The libfido2 documentation at -.Lk https:/\&/developers.yubico.com/libfido2/ . -. -.\" SPDX-License-Identifier: MIT -. -.Sh SPECIAL THANKS -To all who support further development, in particular: -.Bl -bullet -offset 4n -compact -width "@" -.It -ThePhD -.It -Embark Studios -.It -Jasper Bekkers -.It -EvModder -.El -. -.Sh REPORTING BUGS -.Lk https:/\&/todo.sr.ht/\(tinabijaczleweli/fzifdso -.Pp -.Mt \(tinabijaczleweli/tzpfms@lists.sr.ht , -archived at -.Lk https:/\&/lists.sr.ht/\(tinabijaczleweli/tzpfms . diff --git a/zfs-fido2-load-key.8.html b/zfs-fido2-load-key.8.html deleted file mode 100644 index 872519a..0000000 --- a/zfs-fido2-load-key.8.html +++ /dev/null @@ -1,143 +0,0 @@ - - - - - - - - ZFS-FIDO2-LOAD-KEY(8) - - - - - - - - -
ZFS-FIDO2-LOAD-KEY(8)System Manager's ManualZFS-FIDO2-LOAD-KEY(8)
-
-
-

-

zfs-fido2-load-key — - load FIDO2-encrypted ZFS dataset key

-
-
-

- - - - - -
zfs-fido2-load-key[-n] dataset
-
-
-

-

After verifying dataset was encrypted with - the tzpfms - - backend, asserts the preserved challenge, HMACking the salt with the - on-device secret, and loads the resulting key into - dataset.

-

See - zfs-fido2-change-key(8) - for a detailed description.

-
-
-

-
-
-
Do a no-op/dry run, can be used even if the key is already loaded. - Equivalent to zfs - load-key's -n option.
-
-
-
-

-
-
-
By default, passphrases are prompted for and read in on the standard - output and input streams. If - TZPFMS_PASSPHRASE_HELPER is set and nonempty, it - will be run via /bin/sh - -c to provide each passphrase, instead. -

The standard output stream of the helper is tied to an - anonymous file and used in its entirety as the passphrase, except for a - trailing new-line, if any. The arguments are:

-
-
-
-
Pre-formatted noun phrase with all the information below, for use as a - prompt
-
-
Either the dataset name or the device feature being prompted for
-
-
"new" if this is for a new passphrase, otherwise blank
-
-
"again" if it's the second prompt for that passphrase, - otherwise blank
-
-
-

If the helper doesn't exist (the shell exits with - ), a - diagnostic is issued and the normal prompt is used as fall-back. If it - fails for any other reason, the prompting is aborted.

-
-
-
-
-

-
-

-
-
-
If set, enables libfido2 debug logging to the standard error stream.
-
-
-
-

-

When creating, the first device which supports the - ‘hmac-secret’ extension is used. When - loading, the assertion yielding the key is shopped around to every such - device.

-
-
-

-

The libfido2 documentation at - https://developers.yubico.com/libfido2/.

-
-
-
-

-

To all who support further development, in particular:

-
    -
  • ThePhD
    • -
  • Embark Studios
    • -
  • Jasper Bekkers
    • -
  • EvModder
    • -
-
-
-

-

https://todo.sr.ht/~nabijaczleweli/fzifdso

-

~nabijaczleweli/tzpfms@lists.sr.ht, - archived at - https://lists.sr.ht/~nabijaczleweli/tzpfms.

-
-
- - - - - -
March 11, 2024fzifdso 0.4.0
- - diff --git a/zfs-tpm-list.8 b/zfs-tpm-list.8 index 0abf447..e487f24 100644 --- a/zfs-tpm-list.8 +++ b/zfs-tpm-list.8 @@ -3,7 +3,7 @@ .Dd December 4, 2022 .ds doc-volume-operating-system .Dt ZFS-TPM-LIST 8 -.Os tzpfms 0.3.4-34-g48bebe9 +.Os tzpfms 0.4.0 . .Sh NAME .Nm zfs-tpm-list diff --git a/zfs-tpm-list.8.html b/zfs-tpm-list.8.html index 31420c6..232e2e9 100644 --- a/zfs-tpm-list.8.html +++ b/zfs-tpm-list.8.html @@ -166,7 +166,7 @@ tarta-zoot/vm - available yes - +
December 4, 2022tzpfms 0.3.4-34-g48bebe9tzpfms 0.4.0
diff --git a/zfs-tpm1x-change-key.8 b/zfs-tpm1x-change-key.8 index 4f95a59..32fc2c4 100644 --- a/zfs-tpm1x-change-key.8 +++ b/zfs-tpm1x-change-key.8 @@ -3,7 +3,7 @@ .Dd March 11, 2024 .ds doc-volume-operating-system .Dt ZFS-TPM1X-CHANGE-KEY 8 -.Os tzpfms 0.3.4-34-g48bebe9 +.Os tzpfms 0.4.0 . .Sh NAME .Nm zfs-tpm1x-change-key diff --git a/zfs-tpm1x-change-key.8.html b/zfs-tpm1x-change-key.8.html index 3e46fdc..5f78ac3 100644 --- a/zfs-tpm1x-change-key.8.html +++ b/zfs-tpm1x-change-key.8.html @@ -219,7 +219,7 @@ - +
March 11, 2024tzpfms 0.3.4-34-g48bebe9tzpfms 0.4.0
diff --git a/zfs-tpm1x-clear-key.8 b/zfs-tpm1x-clear-key.8 index e6c4ee3..525bf21 100644 --- a/zfs-tpm1x-clear-key.8 +++ b/zfs-tpm1x-clear-key.8 @@ -3,7 +3,7 @@ .Dd March 11, 2024 .ds doc-volume-operating-system .Dt ZFS-TPM1X-CLEAR-KEY 8 -.Os tzpfms 0.3.4-34-g48bebe9 +.Os tzpfms 0.4.0 . .Sh NAME .Nm zfs-tpm1x-clear-key diff --git a/zfs-tpm1x-clear-key.8.html b/zfs-tpm1x-clear-key.8.html index b3eaf67..4e61e61 100644 --- a/zfs-tpm1x-clear-key.8.html +++ b/zfs-tpm1x-clear-key.8.html @@ -104,7 +104,7 @@ - +
March 11, 2024tzpfms 0.3.4-34-g48bebe9tzpfms 0.4.0
diff --git a/zfs-tpm1x-load-key.8 b/zfs-tpm1x-load-key.8 index f83cb82..3e7d296 100644 --- a/zfs-tpm1x-load-key.8 +++ b/zfs-tpm1x-load-key.8 @@ -3,7 +3,7 @@ .Dd March 11, 2024 .ds doc-volume-operating-system .Dt ZFS-TPM1X-LOAD-KEY 8 -.Os tzpfms 0.3.4-34-g48bebe9 +.Os tzpfms 0.4.0 . .Sh NAME .Nm zfs-tpm1x-load-key diff --git a/zfs-tpm1x-load-key.8.html b/zfs-tpm1x-load-key.8.html index a8292f2..f9d48bd 100644 --- a/zfs-tpm1x-load-key.8.html +++ b/zfs-tpm1x-load-key.8.html @@ -139,7 +139,7 @@ - +
March 11, 2024tzpfms 0.3.4-34-g48bebe9tzpfms 0.4.0
diff --git a/zfs-tpm2-change-key.8 b/zfs-tpm2-change-key.8 index 1a14366..63105a6 100644 --- a/zfs-tpm2-change-key.8 +++ b/zfs-tpm2-change-key.8 @@ -3,7 +3,7 @@ .Dd March 11, 2024 .ds doc-volume-operating-system .Dt ZFS-TPM2-CHANGE-KEY 8 -.Os tzpfms 0.3.4-34-g48bebe9 +.Os tzpfms 0.4.0 . .Sh NAME .Nm zfs-tpm2-change-key diff --git a/zfs-tpm2-change-key.8.html b/zfs-tpm2-change-key.8.html index c3b1a7a..3da2cc0 100644 --- a/zfs-tpm2-change-key.8.html +++ b/zfs-tpm2-change-key.8.html @@ -265,7 +265,7 @@ - +
March 11, 2024tzpfms 0.3.4-34-g48bebe9tzpfms 0.4.0
diff --git a/zfs-tpm2-clear-key.8 b/zfs-tpm2-clear-key.8 index 0291170..0d69791 100644 --- a/zfs-tpm2-clear-key.8 +++ b/zfs-tpm2-clear-key.8 @@ -3,7 +3,7 @@ .Dd March 11, 2024 .ds doc-volume-operating-system .Dt ZFS-TPM2-CLEAR-KEY 8 -.Os tzpfms 0.3.4-34-g48bebe9 +.Os tzpfms 0.4.0 . .Sh NAME .Nm zfs-tpm2-clear-key diff --git a/zfs-tpm2-clear-key.8.html b/zfs-tpm2-clear-key.8.html index a83606d..3d8cc7b 100644 --- a/zfs-tpm2-clear-key.8.html +++ b/zfs-tpm2-clear-key.8.html @@ -155,7 +155,7 @@ - +
March 11, 2024tzpfms 0.3.4-34-g48bebe9tzpfms 0.4.0
diff --git a/zfs-tpm2-load-key.8 b/zfs-tpm2-load-key.8 index 411fc5c..bbfe82d 100644 --- a/zfs-tpm2-load-key.8 +++ b/zfs-tpm2-load-key.8 @@ -3,7 +3,7 @@ .Dd March 11, 2024 .ds doc-volume-operating-system .Dt ZFS-TPM2-LOAD-KEY 8 -.Os tzpfms 0.3.4-34-g48bebe9 +.Os tzpfms 0.4.0 . .Sh NAME .Nm zfs-tpm2-load-key diff --git a/zfs-tpm2-load-key.8.html b/zfs-tpm2-load-key.8.html index 9ff2923..585f94e 100644 --- a/zfs-tpm2-load-key.8.html +++ b/zfs-tpm2-load-key.8.html @@ -139,7 +139,7 @@ - +
March 11, 2024tzpfms 0.3.4-34-g48bebe9tzpfms 0.4.0