security/hakurei.app
security/hakurei.app
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 4 Wiki Activity

clarification on encryption algorithm defaults

Browse Source
This commit is contained in:
Daniel Micay 2020-03-17 21:42:46 -04:00
parent a641f31a29
commit 316326ea19
1 changed files with 7 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
static/build.html
View File

@ -431,12 +431,13 @@ mv vendor/android-prepare-vendor/DEVICE/BUILD_ID/vendor/google_devices/* vendor/
your own information.</p> your own information.</p>
<p>You should set a passphrase for the signing keys to keep them at rest until you <p>You should set a passphrase for the signing keys to keep them at rest until you
need to sign a release with them. By default, the keys are encrypted using scrypt for need to sign a release with them. The GrapheneOS scripts (<code>make_key</code> and
key derivation and AES256 as the cipher. If you use swap, make sure it's encrypted, <code>encrypt_keys.sh</code>) encrypt the signing keys using scrypt for key derivation
ideally with an ephemeral key rather a persistent key to support hibernation. Even and AES256 as the cipher. If you use swap, make sure it's encrypted, ideally with an
with an ephemeral key, swap will reduce the security gained from encrypting the keys ephemeral key rather a persistent key to support hibernation. Even with an ephemeral
since it breaks the guarantee that they become at rest as soon as the signing process key, swap will reduce the security gained from encrypting the keys since it breaks the
is finished. Consider disabling swap, at least during the signing process.</p> guarantee that they become at rest as soon as the signing process is finished.
Consider disabling swap, at least during the signing process.</p>
<p>The encryption passphrase for all the keys generated for a device needs to <p>The encryption passphrase for all the keys generated for a device needs to
match.</p> match.</p>