ZFS-FIDO2-CLEAR-KEY(8) System Manager's Manual ZFS-FIDO2-CLEAR-KEY(8)

zfs-fido2-clear-key — rewrap ZFS dataset key in passsword and clear tzpfms FIDO2 metadata

zfs-fido2-clear-key dataset

After verifying dataset was encrypted with the tzpfms backend:

  1. performs the equivalent of zfs change-key -o keylocation=prompt -o keyformat=passphrase dataset,
  2. loads the primary and every backup credential, and for each success, if the device containing it supports the ‘credMgmt’ feature and has a PIN set, tries to delete the credential from the device,
  3. removes the xyz.nabijaczleweli:tzpfms.{backend, key} properties from dataset.

For every removal failure and missing device or PIN an instruction for manual removal with fido2-token(1) is issued.

See zfs-fido2-change-key(8) for a detailed description.

By default, passphrases are prompted for and read in on the standard output and input streams. If TZPFMS_PASSPHRASE_HELPER is set and nonempty, it will be run via /bin/sh -c to provide each passphrase, instead.

The standard output stream of the helper is tied to an anonymous file and used in its entirety as the passphrase, except for a trailing new-line, if any. The arguments are:

Pre-formatted noun phrase with all the information below, for use as a prompt
Either the dataset name or the device feature being prompted for
"new" if this is for a new passphrase, otherwise blank
"again" if it's the second prompt for that passphrase, otherwise blank

If the helper doesn't exist (the shell exits with ), a diagnostic is issued and the normal prompt is used as fall-back. If it fails for any other reason, the prompting is aborted.

If set, enables libfido2 debug logging to the standard error stream.

When creating, the first device which supports the ‘hmac-secret’ extension is used. When loading, the assertion yielding the key is shopped around to every such device.

The libfido2 documentation at https://developers.yubico.com/libfido2/.

To all who support further development, in particular:

https://todo.sr.ht/~nabijaczleweli/fzifdso

~nabijaczleweli/tzpfms@lists.sr.ht, archived at https://lists.sr.ht/~nabijaczleweli/tzpfms.

March 11, 2024 fzifdso 0.4.1