I have done a bit of research and as best that I can see the Librem Key currently does not work with Qubes. Is that correct? I recently received my Purism 13 inch (v4) and installed Qubes immediately (with LUKS encrypted hard drive).
I have the Librem key, but outside of the GPG Key storage it does not seem to have a huge use for my preferred set up at the moment . Is that correct, or (hopefully) am I wrong and I can upgrade the BIOS to use Heads (away from the default version it ships with) and then maximise the use of the Librem Key with the device’s inbuilt security settings and Qubes OS?
I have researched it, and it seems that this may not work.
As an update, I have managed to upgrade the BIOS and it is running Heads, with PureOS. However, I am confused as it seems I can probably simply install a new OS (eg Qubes) and it will not change the BIOS and therefore get the security of the Librem Key to test the BIOS and then Qubes for other / additional security features.
Has anyone tested out this set up at all; or have any input?
As for the steup with the Librem key, Qubes and Heads, I doubht it will work. At least a few weeks ago I was in contact with Mladen about it and at that point, they were still working on an adapted version of Heads to work with the Librem keys.
But I don’t see what would stop you from using HEADS with Qubes.
I’m confused by what you are asking. Changing the OS has no effect on the system firmware
Our Pureboot firmware has worked with the Librem keys since around the beginning of the year, I’m not sure what you or Mladen was referring to. Pureboot + LK + Qubes (or any other distro) works perfectly well
I’m talking about HEADS with LK instead of a smartphone as second factor (which requires an adapted version of HEADS). I had the impression, they were not quite done adapting HEADS to it and I couldn’t find any documentation how it would be set up if it was possible. Maybe I just misinterpreted it and he was only talking about some Pure OS integration (say for updates).
If I get you correctly and it is already possible to set up HEADS with an LK as second factor (for whatever OS), would you please provide a pointer to some documentation (if existent) how this can be done?
I just received my 15v4 with Librem Key. Successfully configured the Key, flashed Heads, added my GPG pubkey to Heads, installed Qubes4.0.2rc1, and then set up the TPM module (in that order). I can see why you would think the Librem Key doesn’t work, due to the Purism Heads-beta-installation-instructions, under the Requirements section.
I think it’s just saying that you can’t flash the BIOS from within QubesOS like you can from within PureOS. However, you could probably still run the script from a Debian VM, save to USB, and then flash the BIOS from within Coreboot.
I just installed the required utils in my debian template vm and ran the script in a vm using that template. I generated the (backup) rom file for coreboot and the one for coreboot-heads, so I guess I just have to flash this file using the latest version of flashrom (say using a debian live system (which I can authentically get along with the newest flashrom package), so no internet access required and it won’t break the security model) to the BIOS.
The other steps should work on Qubes OS just as well as on Debian (or Pure OS for that purpose).
But of cause this is not an acceptable method, seeing that the script is essentially just downloading an unverified binary file from the internet (in my case from https://source.puri.sm/coreboot/releases/raw/cce6af46b69a9e441772e941041fb1f9ce05c03e/librem_15v4/coreboot-heads-l15v4.rom.gz).
Then, I am supposed to just trust and flash this file.
But as long as there are no integrity checks in the process, there is also no way for me to trust the retrieved rom file. Using it would trade the risk of getting compromised in a physical attack against the risk of downloading and flashing a compromised rom file in this procedure. Not sure whether that’s really a good trade-off.
If however, the developers could cryptographically sign the file and allow people to verify its integrity, this issue could easily be avoided…
you’re downloading a precompiled binary from Purism’s site, and the script validates the hash of the downloaded file. All of this is public/viewable from our site. Adding a cryptographic signature doesn’t add much to that, but is on the to-do list.
Yes, but that still won’t help as long as I can’t trust the script (which is also just unauthentically downloaded from the internet). So, I would still need a cryptographic signature of the script for this to be really useful.
And the part of being public/viewable doesn’t change it either. All it really takes is to compromise the website or control a certificate authority and perform a mitm attack.
The website source code is hosted via gitlab and the developers use signed commits, so I can verify the source code of the website including the script, which then includes hashes verifying the authenticity of the binary files.
So this way we can actually get the desired root of trust.
Can somebody please verify the authenticity of one of the following keys (which all certify the validity of the (first) key, I need to trust the script and hence the roms):
@solr1, you ran the smartcard-key-luks script on QubesOS?
The script looks like it is expecting a Debian based system but dom0 is based on Fedora. With the sys-usb VM enabled on my Qubes system, my dom0 does not see the Librem Key to be able to generate the secret key.
If you are indeed using Qubes, how did you get the script or Librem Key to unlock your luks root drive?
I have a 15v4 with Pureboot, and I have been struggling with installing another OS. the OS installs (Fedora 32, Debian 10, Ubuntu 20.04, etc). but the LK, or Heads or whatever it is cannot detect a /boot sector. I can’t seem to get Pureboot setup to detect and the boot from the boot drive?!
@MrChromebox, you mention in this post that “… Pureboot + LK + Qubes (or any other distro) works perfectly well” I’m struggling with getting past PB.
I’ve reset TPM, generated new TOTP/HOTP secrets (sometimes this will fail), changed the /boot drive in the configuration settings, I’ve even tried the option of just “ignore tampering and boot anyway” but, either it get dumped to a recovery shell, or the system hangs or it returns me back to boot options?!
any ideas from anyone, I’m pretty frustrated at this point? what do I need to do with Pureboot and LK to run another OS?
