added --allow-discards flag

update deps
Add Ubuntu fallback to passphrase, add defaults (#35 )
2021-12-28 13:35:34 +01:00 · 2021-12-28 13:32:29 +01:00 · 2021-09-11 16:33:14 +02:00 · 2021-07-26 18:46:10 +02:00 · 2021-07-14 15:47:23 +02:00 · 2021-07-14 12:24:58 +02:00
36 changed files with 3907 additions and 1597 deletions
--- a/.drone.yml
+++ b/.drone.yml
@ -3,12 +3,27 @@ name: default

 steps:
 - name: fmt
-   image: rust:1.37.0
+   image: rust:1.43.0
   commands:
-     -  rustup component add rustfmt
-     -  cargo fmt --all -- --check
+     - rustup component add rustfmt
+     - cargo fmt --all -- --check
 - name: test
-   image: rust:1.37.0
+   image: ubuntu:focal
+   environment:
+    DEBIAN_FRONTEND: noninteractive
   commands:
-    - apt update && apt install -y libcryptsetup-dev libkeyutils-dev
-    - cargo test
+    - apt update && apt install -y cargo libkeyutils-dev libclang-dev clang pkg-config libcryptsetup-dev 
+    - cargo test --locked
+ - name: publish
+   image: ubuntu:focal
+   environment:
+    DEBIAN_FRONTEND: noninteractive
+    CARGO_REGISTRY_TOKEN:
+     from_secret: cargo_tkn
+   commands:
+    - grep -E 'version ?= ?"${DRONE_TAG}"' -i Cargo.toml || (printf "incorrect crate/tag version" && exit 1)
+    - apt update && apt install -y cargo libkeyutils-dev libclang-dev clang pkg-config libcryptsetup-dev 
+    - cargo package --all-features
+    - cargo publish --all-features
+   when:
+    event: tag
--- a/.gitignore
+++ b/.gitignore
@ -2,3 +2,9 @@
 **/*.rs.bk
 .idea/
 *.iml
+fido2luks.bash
+fido2luks.elv
+fido2luks.fish
+fido2luks.zsh
+result
+result-*
--- a/Cargo.lock
+++ b/Cargo.lock
--- a/Cargo.toml
+++ b/Cargo.toml
@ -1,24 +1,56 @@
 [package]
 name = "fido2luks"
-version = "0.1.0"
+version = "0.2.20"
 authors = ["shimunn <shimun@shimun.net>"]
 edition = "2018"

-[dependencies]
-ctap = { git = "https://github.com/shimunn/ctap.git", branch = "hmac_ext" }
-cryptsetup-rs = "0.2.0"
-hex = "0.3.2"
-rust-crypto = "0.2.36"
-failure = "0.1.5"
-serde_derive = "1.0.100"
-serde = "1.0.100"
-serde_json = "1.0.40"
-keyutils = "0.2.1"
-rpassword = "4.0.1"
-envy = "0.4.0"
+description = "Decrypt your LUKS partition using a FIDO2 compatible authenticator"
+documentation = "https://github.com/shimunn/fido2luks/blob/master/README.md"
+homepage = "https://github.com/shimunn/fido2luks"
+repository = "https://github.com/shimunn/fido2luks"
+readme = "README.md"
+keywords = ["luks", "fido2", "u2f"]
+categories = ["command-line-utilities"]
+license = "MPL-2.0"

+[dependencies]
+ctap_hmac = { version="0.4.5", features = ["request_multiple"] }
+hex = "0.3.2"
+ring = "0.13.5"
+failure = "0.1.5"
+rpassword = "4.0.1"
+structopt = "0.3.2"
+libcryptsetup-rs = "0.4.1"
+serde_json = "1.0.51"
+serde_derive = "1.0.106"
+serde = "1.0.106"
+
+[build-dependencies]
+ctap_hmac = { version="0.4.5", features = ["request_multiple"] }
+hex = "0.3.2"
+ring = "0.13.5"
+failure = "0.1.5"
+rpassword = "4.0.1"
+libcryptsetup-rs = "0.4.1"
+structopt = "0.3.2"

 [profile.release]
 lto = true
 opt-level = 'z'
 panic = 'abort'
+incremental = false
+overflow-checks = false
+
+[package.metadata.deb]
+depends = "$auto, cryptsetup"
+build-depends = "libclang-dev, libcryptsetup-dev"
+extended-description = "Decrypt your LUKS partition using a FIDO2 compatible authenticator"
+assets = [
+    ["target/release/fido2luks", "usr/bin/", "755"],
+    ["fido2luks.bash", "usr/share/bash-completion/completions/fido2luks", "644"],
+    ["pam_mount/fido2luksmounthelper.sh", "usr/bin/", "755"],
+    ["initramfs-tools/keyscript.sh", "/lib/cryptsetup/scripts/fido2luks", "755" ],
+    ["initramfs-tools/hook/fido2luks.sh", "etc/initramfs-tools/hooks/", "755" ],
+    ["initramfs-tools/fido2luks.conf", "etc/", "644"],
+]
+conf-files = ["/etc/fido2luks.conf"]
--- a/1047
+++ b/1047
--- a/37
+++ b/37
@ -0,0 +1,37 @@
+# Maintainer: shimunn <shimun@shimun.net>
+
+pkgname=fido2luks-git
+pkgver=0.2.16.7e6b33a
+pkgrel=1
+makedepends=('rust' 'cargo' 'cryptsetup' 'clang' 'git')
+depends=('cryptsetup')
+arch=('i686' 'x86_64' 'armv6h' 'armv7h')
+pkgdesc="Decrypt your LUKS partition using a FIDO2 compatible authenticator"
+url="https://github.com/shimunn/fido2luks"
+license=('MPL-2.0')
+source=('git+https://github.com/shimunn/fido2luks')
+sha512sums=('SKIP')
+
+pkgver() {
+    cd fido2luks
+
+    # Use tag version if possible otherwise concat project version and git ref
+    git describe --exact-match --tags HEAD 2>/dev/null ||
+        echo "$(cargo pkgid | cut -d'#' -f2).$(git describe --always)"
+}
+
+build() {
+    cd fido2luks
+    cargo build --release --locked --all-features --target-dir=target
+}
+
+package() {
+    cd fido2luks
+
+    install -Dm 755 target/release/fido2luks -t "${pkgdir}/usr/bin"
+    install -Dm 755 pam_mount/fido2luksmounthelper.sh -t "${pkgdir}/usr/bin"
+    install -Dm 644 initcpio/hooks/fido2luks -t "${pkgdir}/usr/lib/initcpio/hooks"
+    install -Dm 644 initcpio/install/fido2luks -t "${pkgdir}/usr/lib/initcpio/install"
+    install -Dm 644 fido2luks.bash "${pkgdir}/usr/share/bash-completion/completions/fido2luks"
+    install -Dm 644 fido2luks.fish -t "${pkgdir}/usr/share/fish/vendor_completions.d"
+}
--- a/README.md
+++ b/README.md
@ -1,33 +1,45 @@
-# fido2luks
+# fido2luks [![Crates.io Version](https://img.shields.io/crates/v/fido2luks.svg)](https://crates.io/crates/fido2luks)

-This will allow you to unlock your luks encrypted disk with an fido2 compatable key
+This will allow you to unlock your LUKS encrypted disk with an FIDO2 compatible key.

-Note: This has only been tested under Fedora 30 using a Solo Key
+Note: This has only been tested under Fedora 31, [Ubuntu 20.04](initramfs-tools/), [NixOS](https://nixos.org/nixos/manual/#sec-luks-file-systems-fido2) using a Solo Key, Trezor Model T, YubiKey(fw >= [5.2.3](https://support.yubico.com/hc/en-us/articles/360016649319-YubiKey-5-2-3-Enhancements-to-FIDO-2-Support))

 ## Setup

-## Device
+### Prerequisites
+
+```
+dnf install clang cargo cryptsetup-devel -y
+```
+
+### Device

 ```
 git clone https://github.com/shimunn/fido2luks.git && cd fido2luks

-#Alternativly cargo build --release && sudo cp target/release/fido2luks /usr/bin/
-CARGO_INSTALL_ROOT=/usr sudo -E cargo install -f --path .
+# Alternativly cargo build --release && sudo cp target/release/fido2luks /usr/bin/
+sudo -E cargo install -f --path . --root /usr

-echo FIDO2LUKS_CREDENTIAL_ID=$(fido2luks credential) >> fido2luks.conf
+# Copy template
+cp dracut/96luks-2fa/fido2luks.conf /etc/
+# Name is optional but useful if your authenticator has a display
+echo FIDO2LUKS_CREDENTIAL_ID=$(fido2luks credential [NAME]) >> /etc/fido2luks.conf

+# Load config into env
 set -a
-. fido2luks.conf
+. /etc/fido2luks.conf

-#Repeat for each luks volume
-FIDO2LUKS_PASSWORD_HELPER=stdin sudo -E fido2luks addkey /dev/disk/by-uuid/<DISK_UUID>
+# Repeat for each luks volume
+# You can also use the `--token` flag when using LUKS2 which will then store the credential in the LUKS header,
+# enabling you to use `fido2luks open-token` without passing a credential as parameter
+sudo -E fido2luks -i add-key /dev/disk/by-uuid/<DISK_UUID>

-#Test(only works if the luks container isn't active)
-FIDO2LUKS_PASSWORD_HELPER=stdin sudo -E fido2luks open /dev/disk/by-uuid/<DISK_UUID> luks-<DISK_UUID>
+# Test(only works if the luks container isn't active)
+sudo -E fido2luks -i open /dev/disk/by-uuid/<DISK_UUID> luks-<DISK_UUID>

 ```

-## Dracut
+### Dracut

 ```
 cd dracut
@ -35,24 +47,114 @@ cd dracut
 sudo make install
 ```

-## Grub
+### Grub

-Add `rd.luks.2fa=<CREDENTIAL_ID>:<DISK_UUID>` to `GRUB_CMDLINE_LINUX`
+Add `rd.luks.2fa=<CREDENTIAL_ID>:<DISK_UUID>` to `GRUB_CMDLINE_LINUX` in /etc/default/grub

-Note: This is only required for your root disk, systemd will try to unlock all other luks partions using the same key if you added it using `fido2luks addkey`
+Note: This is only required for your root disk, systemd will try to unlock all other LUKS partions using the same key if you added it using `fido2luks add-key`

 ```
 grub2-mkconfig > /boot/grub2/grub.cfg
 ```

-## Test
-
-Just reboot and see if it works, if thats the case you should remove your old less secure password from your luks header:
+I'd also recommend to copy the executable onto /boot so that it is accessible in case you have to access your disk from a rescue system

 ```
-#Recommend in case you lose your authenticator, store this backupfile somewhere safe
+mkdir /boot/fido2luks/
+cp /usr/bin/fido2luks /boot/fido2luks/
+cp /etc/fido2luks.conf /boot/fido2luks/
+```
+
+## Testing
+
+Just reboot and see if it works, if that's the case you should remove your old less secure password from your LUKS header:
+
+```
+# Recommend in case you lose your authenticator, store this backupfile somewhere safe
 cryptsetup luksHeaderBackup /dev/disk/by-uuid/<DISK_UUID> --header-backup-file luks_backup_<DISK_UUID>
-#Slot should be 0 if you only had one previous password otherwise consult cryptsetup luksDump
-#There is no turning back if you mess this up, make sure you made a backup
-cryptsetup luksKillSlot /dev/disk/by-uuid/<DISK_UUID> <SLOT>
+# There is no turning back if you mess this up, make sure you made a backup
+# You can also pass `--token` if you're using LUKS2 which will then store the credential in the LUKS header,
+# which will enable you to use `fido2luks open-token` without passing a credential as parameter
+fido2luks -i add-key --exclusive /dev/disk/by-uuid/<DISK_UUID>
 ```
+
+## Addtional settings
+
+### Password less
+
+Remove your previous secret as described in the next section, in case you've already added one.
+
+Open `/etc/fido2luks.conf` and replace `FIDO2LUKS_SALT=Ask` with `FIDO2LUKS_SALT=string:<YOUR_RANDOM_STRING>`
+but be warned that this password will be included to into your initramfs.
+
+Import the new config into env:
+
+```
+set -a
+. /etc/fido2luks.conf
+```
+
+Then add the new secret to each device and update dracut afterwards `dracut -f`
+
+### Multiple keys
+
+Additional/backup keys are supported, Multiple fido2luks credentials can be added to your /etc/fido2luks.conf file. Credential tokens are comma separated.
+```
+FIDO2LUKS_CREDENTIAL_ID=<CREDENTIAL1>,<CREDENTIAL2>,<CREDENTIAL3>
+```
+
+## Removal
+
+Remove `rd.luks.2fa` from `GRUB_CMDLINE_LINUX` in /etc/default/grub
+
+```
+set -a
+. fido2luks.conf
+sudo -E fido2luks -i replace-key /dev/disk/by-uuid/<DISK_UUID>
+
+sudo rm -rf /usr/lib/dracut/modules.d/96luks-2fa /etc/dracut.conf.d/luks-2fa.conf /etc/fido2luks.conf
+```
+
+## Theory of operation
+
+fido2luks builds on two basic building blocks, LUKS as an abstraction over linux disk encryption and and the FIDO2 extension [`hmac-secret`](https://fidoalliance.org/specs/fido-v2.0-rd-20180702/fido-client-to-authenticator-protocol-v2.0-rd-20180702.html#sctn-hmac-secret-extension).
+The `hmac-secret` extension allows for an secret to be dervied on the FIDO2 device from two inputs, the user supplied salt/password/keyfile and another secret contained within the FID2 device. The output of the `hmac-secret` function will then be used to decrypt the LUKS header which in turn is used to decrypt the disk.
+```
+
+        +-------------------------------------------------------------------------------+
+        |                                                                               |
+        |                       +-----------------------------------------+             |
+        |                       |               FIDO2 device              |             |
+        |                       |                                         |             |
+        |                       |                                         |             |
+-------+--------+   +------+   |                      +---------------+  |             |             +------------------------+
+| Salt/Password  +-> |sha256+------------------------> |               |  |             v             |      LUKS header       |
+----------------+   +------+   |                      |               |  |                           |                        |           +---------------+   
+                                |                      |               |  |        +--------+         +------------------------+-------->  |Disk master key| 
+                                |                      |  sha256_hmac  +---------> | sha256 +-------> | Keyslot 1              |           +---------------+ 
+----------------+              |  +----------+        |               |  |        +--------+         +------------------------+
+| FIDO credential+---------------> |Credential| +----> |               |  |                           | Keyslot 2              |
+----------------+              |  |secret    |        |               |  |                           +------------------------+
+                                |  +----------+        +---------------+  |
+                                |                                         |
+                                |                                         |
+                                +-----------------------------------------+
+
+```
+Since all these components build upon each other losing or damaging just one of them will render the disk undecryptable, it's threfore of paramount importance to backup the LUKS header and ideally set an backup password
+or utilise more than one FIDO2 device. Each additional credential and password combination will require it's own LUKS keyslot since the credential secret is randomly generated for each new credential and will thus result
+in a completly different secret.
+
+## License
+
+Licensed under
+
+ * Mozilla Public License 2.0, ([LICENSE-MPL](LICENSE-MPL) or https://www.mozilla.org/en-US/MPL/2.0/)
+
+### Contribution
+
+Unless you explicitly state otherwise, any contribution intentionally
+submitted for inclusion in the work by you, as defined in the MPL 2.0
+license, shall be licensed as above, without any additional terms or
+conditions.
+
--- a/build.rs
+++ b/build.rs
@ -0,0 +1,24 @@
+#![allow(warnings)]
+#[macro_use]
+extern crate failure;
+extern crate ctap_hmac as ctap;
+
+#[path = "src/cli_args/mod.rs"]
+mod cli_args;
+#[path = "src/error.rs"]
+mod error;
+#[path = "src/util.rs"]
+mod util;
+
+use cli_args::Args;
+use std::env;
+use std::str::FromStr;
+use structopt::clap::Shell;
+use structopt::StructOpt;
+
+fn main() {
+    // generate completion scripts, zsh does panic for some reason
+    for shell in Shell::variants().iter().filter(|shell| **shell != "zsh") {
+        Args::clap().gen_completions(env!("CARGO_PKG_NAME"), Shell::from_str(shell).unwrap(), ".");
+    }
+}
--- a/dracut/96luks-2fa/fido2luks.conf
+++ b/dracut/96luks-2fa/fido2luks.conf
@ -0,0 +1,3 @@
+FIDO2LUKS_SALT=Ask
+FIDO2LUKS_PASSWORD_HELPER=/usr/bin/systemd-ask-password Please enter second factor for LUKS disk encryption
+
--- a/dracut/96luks-2fa/luks-2fa-generator.sh
+++ b/dracut/96luks-2fa/luks-2fa-generator.sh
@ -5,11 +5,11 @@ LUKS_2FA_WANTS="/etc/systemd/system/luks-2fa.target.wants"

 CRYPTSETUP="/usr/lib/systemd/systemd-cryptsetup"
 FIDO2LUKS="/usr/bin/fido2luks"
-XXD="/usr/bin/xxd"
 MOUNT=$(command -v mount)
 UMOUNT=$(command -v umount)

-TIMEOUT=30
+TIMEOUT=120
+CON_MSG="Please connect your authenticator"

 generate_service () {
        local credential_id=$1 target_uuid=$2 timeout=$3 sd_dir=${4:-$NORMAL_DIR}
@ -19,28 +19,27 @@ generate_service () {

        local crypto_target_service="systemd-cryptsetup@luks\x2d${sd_target_uuid}.service"
        local sd_service="${sd_dir}/luks-2fa@luks\x2d${sd_target_uuid}.service"
+        local fido2luks_args="--bin"
+        if [ ! -z "$timeout" ]; then
+          fido2luks_args="$fido2luks_args --await-dev ${timeout}"
+        fi
        {
                printf -- "[Unit]"
                printf -- "\nDescription=%s" "2fa for luks"
                printf -- "\nBindsTo=%s" "$target_dev"
-                printf -- "\nAfter=%s cryptsetup-pre.target systemd-journald.socket" "$target_dev" #TODO: create service to wait or authenicator
+                printf -- "\nAfter=%s cryptsetup-pre.target systemd-journald.socket" "$target_dev"
                printf -- "\nBefore=%s umount.target luks-2fa.target" "$crypto_target_service"
                printf -- "\nConflicts=umount.target"
                printf -- "\nDefaultDependencies=no"
-                printf -- "\nJobTimeoutSec=%s" "$timeout"
-
+                [ ! -z "$timeout" ] && printf -- "\nJobTimeoutSec=%s" "$timeout"
                printf -- "\n\n[Service]"
                printf -- "\nType=oneshot"
                printf -- "\nRemainAfterExit=yes"
-                printf -- "\nEnvironment=FIDO2LUKS_CREDENTIAL_ID='%s'" "$credential_id"
-                printf -- "\nEnvironment=FIDO2LUKS_SALT='%s'" "Ask"
-                printf -- "\nEnvironment=FIDO2LUKS_PASSWORD_HELPER='%s'" "/usr/bin/systemd-ask-password \"Disk 2fa password\""
+                printf -- "\nEnvironmentFile=%s" "/etc/fido2luks.conf"
+                [ ! -z "$credential_id" ] && printf -- "\nEnvironment=FIDO2LUKS_CREDENTIAL_ID='%s'" "$credential_id"
                printf -- "\nKeyringMode=%s" "shared"
-                #printf -- "\nExecStart=${CRYPTSETUP} attach 'luks-%s' '/dev/disk/by-uuid/%s' 'none'" "$keyfile_uuid" "$keyfile_uuid"   #LUKS on USB
-                #printf -- "\nExecStart=${MOUNT} '/dev/mapper/luks-%s' %s" "$keyfile_uuid" "$keyfile_mountpoint"                        #Mount keyfile
-                printf -- "\nExecStart=/bin/bash -c \"${FIDO2LUKS} print-secret | ${XXD} -r -p - | ${CRYPTSETUP} attach 'luks-%s' '/dev/disk/by-uuid/%s' '/dev/stdin'\"" "$target_uuid" "$target_uuid"
-                #printf -- "\nExecStart=${UMOUNT} '%s'" "$keyfile_mountpoint"
-                #printf -- "\nExecStart=${CRYPTSETUP} detach 'luks-%s'" "$keyfile_uuid"
+		            printf -- "\nExecStartPre=-/usr/bin/plymouth display-message --text \"${CON_MSG}\""
+                printf -- "\nExecStart=/bin/bash -c \"${FIDO2LUKS} print-secret $fido2luks_args | ${CRYPTSETUP} attach 'luks-%s' '/dev/disk/by-uuid/%s' '/dev/stdin'\"" "$target_uuid" "$target_uuid"
                printf -- "\nExecStop=${CRYPTSETUP} detach 'luks-%s'" "$target_uuid"
        } > "$sd_service"

--- a/dracut/96luks-2fa/module-setup.sh
+++ b/dracut/96luks-2fa/module-setup.sh
@ -17,14 +17,14 @@ depends () {

 install () {
        inst "$moddir/luks-2fa-generator.sh" "/etc/systemd/system-generators/luks-2fa-generator.sh"
-        inst_simple "/usr/bin/xxd" "/usr/bin/xxd"
        inst_simple "/usr/bin/fido2luks" "/usr/bin/fido2luks"
+        inst_simple "/etc/fido2luks.conf" "/etc/fido2luks.conf"
        inst "$systemdutildir/systemd-cryptsetup"
        mkdir -p "$initdir/luks-2fa"

        inst "$moddir/luks-2fa.target" "/etc/systemd/system/luks-2fa.target"
        mkdir -p "$initdir/etc/systemd/system/luks-2fa.target.wants"
-
+        
        mkdir -p "$initdir/etc/systemd/system/sysinit.target.wants"
        ln -sf "/etc/systemd/system/luks-2fa.target" "$initdir/etc/systemd/system/sysinit.target.wants/"
 }
--- a/dracut/Makefile
+++ b/dracut/Makefile
@ -15,6 +15,7 @@ help:
 install:
 	cp ${MODULE_CONF_D}/${MODULE_CONF} ${DRACUT_CONF_D}/
 	cp -r ${MODULE_DIR} ${DRACUT_MODULES_D}/
+	cp ${MODULE_DIR}/fido2luks.conf /etc/fido2luks.conf
 	dracut -fv
 clean:
 	rm ${DRACUT_CONF_D}/${MODULE_CONF}
--- a/flake.lock
+++ b/flake.lock
@ -0,0 +1,62 @@
+{
+  "nodes": {
+    "naersk": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1639947939,
+        "narHash": "sha256-pGsM8haJadVP80GFq4xhnSpNitYNQpaXk4cnA796Cso=",
+        "owner": "nmattia",
+        "repo": "naersk",
+        "rev": "2fc8ce9d3c025d59fee349c1f80be9785049d653",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nmattia",
+        "repo": "naersk",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1638109994,
+        "narHash": "sha256-OpA37PTiPMIqoRJbufbl5rOLII7HeeGcA0yl7FoyCIE=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "a284564b7f75ac4db73607db02076e8da9d42c9d",
+        "type": "github"
+      },
+      "original": {
+        "id": "nixpkgs",
+        "type": "indirect"
+      }
+    },
+    "root": {
+      "inputs": {
+        "naersk": "naersk",
+        "nixpkgs": "nixpkgs",
+        "utils": "utils"
+      }
+    },
+    "utils": {
+      "locked": {
+        "lastModified": 1638122382,
+        "narHash": "sha256-sQzZzAbvKEqN9s0bzWuYmRaA03v40gaJ4+iL1LXjaeI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "74f7e4319258e287b0f9cb95426c9853b282730b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
--- a/flake.nix
+++ b/flake.nix
@ -0,0 +1,61 @@
+{
+  description = "Decrypt your LUKS partition using a FIDO2 compatible authenticator";
+
+  inputs = {
+    utils.url = "github:numtide/flake-utils";
+    naersk = {
+      url = "github:nmattia/naersk";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+  };
+
+  outputs = { self, nixpkgs, utils, naersk }:
+    let
+      root = ./.;
+      pname = (builtins.fromTOML (builtins.readFile ./Cargo.toml)).package.name;
+      forPkgs = pkgs:
+        let
+          naersk-lib = naersk.lib."${pkgs.system}";
+          buildInputs = with pkgs; [ cryptsetup ];
+          LIBCLANG_PATH = "${pkgs.clang.cc.lib}/lib";
+          nativeBuildInputs = with pkgs; [
+            pkgconfig
+            clang
+          ];
+        in
+        rec {
+          # `nix build`
+          packages.${pname} = naersk-lib.buildPackage {
+            inherit pname root buildInputs nativeBuildInputs LIBCLANG_PATH;
+          };
+          defaultPackage = packages.${pname};
+
+          # `nix run`
+          apps.${pname} = utils.lib.mkApp {
+            drv = packages.${pname};
+          };
+          defaultApp = apps.${pname};
+
+          # `nix flake check`
+          checks = {
+            fmt = with pkgs; runCommandLocal "${pname}-fmt" { buildInputs = [ cargo rustfmt nixpkgs-fmt ]; } ''
+              cd ${root}
+              cargo fmt -- --check
+              nixpkgs-fmt --check *.nix
+              touch $out
+            '';
+          };
+
+          # `nix develop`
+          devShell = pkgs.mkShell {
+            nativeBuildInputs = with pkgs; [ rustc cargo rustfmt nixpkgs-fmt ] ++ nativeBuildInputs;
+            inherit buildInputs LIBCLANG_PATH;
+          };
+        };
+      forSystem = system: forPkgs nixpkgs.legacyPackages."${system}";
+    in
+    (utils.lib.eachSystem [ "aarch64-linux" "i686-linux" "x86_64-linux" ] forSystem) // {
+      overlay = final: prev: (forPkgs final).packages;
+    };
+
+}
--- a/initcpio/Makefile
+++ b/initcpio/Makefile
@ -0,0 +1,18 @@
+.PHONY: install remove
+
+install:
+	install -Dm644 hooks/fido2luks -t /usr/lib/initcpio/hooks
+	install -Dm644 install/fido2luks -t /usr/lib/initcpio/install
+ifdef preset
+	mkinitcpio -p $(preset)
+else
+	mkinitcpio -P
+endif
+
+remove:
+	rm /usr/lib/initcpio/{hooks,install}/fido2luks
+ifdef preset
+	mkinitcpio -p $(preset)
+else
+	mkinitcpio -P
+endif
--- a/initcpio/README.md
+++ b/initcpio/README.md
@ -0,0 +1,52 @@
+## fido2luks hook for mkinitcpio (ArchLinux and derivatives)
+
+> ⚠️ Before proceeding, it is very advised to [backup your existing LUKS2 header](https://wiki.archlinux.org/title/dm-crypt/Device_encryption#Backup_using_cryptsetup) to external storage
+
+### Setup
+
+1. Connect your FIDO2 authenticator
+2. Generate credential id
+
+```shell
+fido2luks credential
+```
+
+3. Generate salt (random string)
+
+```shell
+pwgen 48 1
+```
+
+4. Add key to your LUKS2 device
+
+```shell
+fido2luks add-key -Pt --salt <salt> <block_device> <credential_id>
+```
+
+`-P` - request PIN to unlock the authenticator  
+`-t` - add token (including credential id) to the LUKS2 header  
+`-e` - wipe all other keys  
+
+For the full list of options see `fido2luks add-key --help`
+
+5. Edit [/etc/fido2luks.conf](/initcpio/fido2luks.conf)
+
+Keyslot (`FIDO2LUKS_DEVICE_SLOT`) can be obtained from the output of
+
+```shell
+cryptsetup luksDump <block_device>
+```
+
+6. Add fido2luks hook to /etc/mkinitcpio.conf
+
+Before or instead of `encrypt` hook, for example:
+
+```shell
+HOOKS=(base udev autodetect modconf keyboard block fido2luks filesystems fsck)
+```
+
+7. Recreate initial ramdisk
+
+```shell
+mkinitcpio -p <preset>
+```
--- a/initcpio/fido2luks.conf
+++ b/initcpio/fido2luks.conf
@ -0,0 +1,18 @@
+# Set credential *ONLY IF* it's not embedded in the LUKS2 header
+FIDO2LUKS_CREDENTIAL_ID=
+
+# Encrypted device and its name under /dev/mapper
+# Can be overridden by `cryptdevice` kernel parameter
+FIDO2LUKS_DEVICE=
+FIDO2LUKS_MAPPER_NAME=
+
+FIDO2LUKS_SALT=string:<salt>
+
+# Use specific keyslot (ignore all other slots)
+FIDO2LUKS_DEVICE_SLOT=
+
+# Await for an authenticator to be connected (in seconds)
+FIDO2LUKS_DEVICE_AWAIT=
+
+# Set to 1 if PIN is required to unlock the authenticator
+FIDO2LUKS_ASK_PIN=
--- a/initcpio/hooks/fido2luks
+++ b/initcpio/hooks/fido2luks
@ -0,0 +1,55 @@
+#!/usr/bin/ash
+
+run_hook() {
+    modprobe -a -q dm-crypt >/dev/null 2>&1
+    . /etc/fido2luks.conf
+
+    if [ -z "$cryptdevice" ]; then
+        device="$FIDO2LUKS_DEVICE"
+        dmname="$FIDO2LUKS_MAPPER_NAME"
+    else
+        IFS=: read cryptdev dmname _cryptoptions <<EOF
+$cryptdevice
+EOF
+        if ! device=$(resolve_device "${cryptdev}" ${rootdelay}); then
+            return 1
+        fi
+    fi
+
+    options="--salt $FIDO2LUKS_SALT"
+
+    if [ "$FIDO2LUKS_ASK_PIN" == 1 ]; then
+        options="$options --pin"
+    fi
+
+    if [ -n "$FIDO2LUKS_DEVICE_SLOT" ]; then
+        options="$options --slot $FIDO2LUKS_DEVICE_SLOT"
+    fi
+
+    if [ -n "$FIDO2LUKS_DEVICE_AWAIT" ]; then
+        options="$options --await-dev $FIDO2LUKS_DEVICE_AWAIT"
+    fi
+
+    # HACK: /dev/tty is hardcoded in rpassword, but not accessible from the ramdisk
+    # Temporary link it to /dev/tty1
+    mv /dev/tty /dev/tty.back
+    ln -s /dev/tty1 /dev/tty
+
+    printf "\nAuthentication is required to access the $dmname volume at $device\n"
+
+    if [ -z "$FIDO2LUKS_CREDENTIAL_ID" ]; then
+        fido2luks open-token $device $dmname $options
+    else
+        fido2luks open $device $dmname $FIDO2LUKS_CREDENTIAL_ID $options
+    fi
+    exit_code=$?
+
+    # Restore /dev/tty
+    mv /dev/tty.back /dev/tty
+
+    if [ $exit_code -ne 0 ]; then
+        printf '\n'
+        read -s -p 'Press Enter to continue'
+        printf '\n'
+    fi
+}
--- a/initcpio/install/fido2luks
+++ b/initcpio/install/fido2luks
@ -0,0 +1,31 @@
+#!/bin/bash
+
+build() {
+    local mod
+
+    add_module dm-crypt
+    add_module dm-integrity
+    if [[ $CRYPTO_MODULES ]]; then
+        for mod in $CRYPTO_MODULES; do
+            add_module "$mod"
+        done
+    else
+        add_all_modules /crypto/
+    fi
+
+    add_binary fido2luks
+    add_binary dmsetup
+    add_file /usr/lib/udev/rules.d/10-dm.rules
+    add_file /usr/lib/udev/rules.d/13-dm-disk.rules
+    add_file /usr/lib/udev/rules.d/95-dm-notify.rules
+    add_file /usr/lib/initcpio/udev/11-dm-initramfs.rules /usr/lib/udev/rules.d/11-dm-initramfs.rules
+    add_file /etc/fido2luks.conf /etc/fido2luks.conf
+
+    add_runscript
+}
+
+help() {
+    cat <<HELPEOF
+This hook allows to decrypt LUKS2 partition using FIDO2 compatible authenticator
+HELPEOF
+}
--- a/initramfs-tools/Makefile
+++ b/initramfs-tools/Makefile
@ -0,0 +1,11 @@
+.PHONY: install
+install:
+	chmod +x hook/fido2luks.sh keyscript.sh
+	cp -f hook/fido2luks.sh /etc/initramfs-tools/hooks/
+	mkdir -p /usr/share/fido2luks
+	cp -f keyscript.sh /lib/cryptsetup/scripts/fido2luks
+	update-initramfs -u
+remove:
+	sh -c "grep 'keyscript=fido2luks' -i /etc/crypttab && ( echo 'ERROR: your system is still setup to use fido2luks during boot' && exit 1) || exit 0"
+	rm /etc/initramfs-tools/hooks/fido2luks.sh /lib/cryptsetup/scripts/fido2luks
+	update-initramfs -u
--- a/initramfs-tools/README.md
+++ b/initramfs-tools/README.md
@ -0,0 +1,34 @@
+## Initramfs-tools based systems(Ubuntu and derivatives)
+
+For easiest installation [download and install the precompiled deb from releases.](https://github.com/shimunn/fido2luks/releases). However it is possible to build from source via the instructions on the main readme.
+
+```
+sudo -s
+
+# Insert FIDO key.
+fido2luks credential
+# Tap FIDO key
+# Copy returned string <CREDENTIAL>
+
+nano /etc/fido2luks.conf
+# Insert <CREDENTIAL> 
+# FIDO2LUKS_CREDENTIAL_ID=<CREDENTIAL> 
+
+set -a
+. /etc/fido2luks.conf
+fido2luks -i add-key /dev/<LUKS PARTITION>
+# Current password: <Any current LUKS password>
+# Password: <Password used as FIDO challange>
+# Tap FIDO key
+
+nano /etc/crypttab
+# Append to end ",discard,initramfs,keyscript=fido2luks"
+# E.g. sda6_crypt UUID=XXXXXXXXXX none luks,discard,initramfs,keyscript=fido2luks
+
+update-initramfs -u
+
+
+```
+
+[Recording showing part of the setup](https://shimun.net/fido2luks/setup.svg)
+
--- a/initramfs-tools/fido2luks.conf
+++ b/initramfs-tools/fido2luks.conf
@ -0,0 +1,5 @@
+FIDO2LUKS_SALT=Ask
+#FIDO2LUKS_PASSWORD_HELPER="/usr/bin/plymouth ask-for-password --prompt 'FIDO2 password salt'"
+FIDO2LUKS_CREDENTIAL_ID=
+FIDO2LUKS_USE_TOKEN=0
+FIDO2LUKS_PASSWORD_FALLBACK=1
--- a/initramfs-tools/hook/fido2luks.sh
+++ b/initramfs-tools/hook/fido2luks.sh
@ -0,0 +1,14 @@
+#!/bin/sh
+
+case "$1" in
+prereqs)
+	echo ""
+	exit 0
+	;;
+
+esac
+
+. /usr/share/initramfs-tools/hook-functions
+copy_file config /etc/fido2luks.conf /etc/fido2luks.conf
+copy_exec /usr/bin/fido2luks
+exit 0
--- a/initramfs-tools/keyscript.sh
+++ b/initramfs-tools/keyscript.sh
@ -0,0 +1,30 @@
+#!/bin/sh
+set -a
+. /etc/fido2luks.conf
+
+# Set Defaults
+if [ -z "$FIDO2LUKS_USE_TOKEN" ]; then
+    FIDO2LUKS_USE_TOKEN=0
+fi
+
+if [ -z "$FIDO2LUKS_PASSWORD_FALLBACK" ]; then
+    FIDO2LUKS_PASSWORD_FALLBACK=1
+fi
+
+
+
+if [ -z "$FIDO2LUKS_PASSWORD_HELPER" ]; then
+	MSG="FIDO2 password salt for $CRYPTTAB_NAME"
+	export FIDO2LUKS_PASSWORD_HELPER="plymouth ask-for-password --prompt '$MSG'"
+fi
+
+if [ "$FIDO2LUKS_USE_TOKEN" -eq 1 ]; then
+	export FIDO2LUKS_CREDENTIAL_ID="$FIDO2LUKS_CREDENTIAL_ID,$(fido2luks token list --csv $CRYPTTAB_SOURCE)"
+fi
+
+fido2luks print-secret --bin
+
+# Fall back to passphrase-based unlock if fido2luks fails
+if [ "$?" -gt 0 ] && [ "$FIDO2LUKS_PASSWORD_FALLBACK" -eq 1 ]; then
+  plymouth ask-for-password --prompt "Password for $CRYPTTAB_SOURCE"
+fi
--- a/initramfs-tools/setup.svg
+++ b/initramfs-tools/setup.svg
--- a/pam_mount/fido2luksmounthelper.sh
+++ b/pam_mount/fido2luksmounthelper.sh
@ -0,0 +1,220 @@
+#!/bin/bash
+#
+# This is a rather minimal example Argbash potential
+# Example taken from http://argbash.readthedocs.io/en/stable/example.html
+#
+# ARG_POSITIONAL_SINGLE([operation],[Operation to perform (mount|umount)],[])
+# ARG_OPTIONAL_SINGLE([credentials-type],[c],[Type of the credentials to use (external|embedded)])
+# ARG_OPTIONAL_SINGLE([device],[d],[Name of the device to create])
+# ARG_OPTIONAL_SINGLE([mount-point],[m],[Path of the mount point to use])
+# ARG_OPTIONAL_BOOLEAN([ask-pin],[a],[Ask for a pin],[off])
+# ARG_OPTIONAL_SINGLE([salt],[s],[Salt to use],[""])
+# ARG_HELP([Unlocks/Locks a LUKS volume and mount/unmount it in the given mount point.])
+# ARGBASH_GO()
+# needed because of Argbash --> m4_ignore([
+### START OF CODE GENERATED BY Argbash v2.9.0 one line above ###
+# Argbash is a bash code generator used to get arguments parsing right.
+# Argbash is FREE SOFTWARE, see https://argbash.io for more info
+# Generated online by https://argbash.io/generate
+
+
+die()
+{
+	local _ret="${2:-1}"
+	test "${_PRINT_HELP:-no}" = yes && print_help >&2
+	echo "$1" >&2
+	exit "${_ret}"
+}
+
+
+begins_with_short_option()
+{
+	local first_option all_short_options='cdmash'
+	first_option="${1:0:1}"
+	test "$all_short_options" = "${all_short_options/$first_option/}" && return 1 || return 0
+}
+
+# THE DEFAULTS INITIALIZATION - POSITIONALS
+_positionals=()
+# THE DEFAULTS INITIALIZATION - OPTIONALS
+_arg_credentials_type=
+_arg_device=
+_arg_mount_point=
+_arg_ask_pin="off"
+_arg_salt=""
+
+
+print_help()
+{
+	printf '%s\n' "Unlocks/Locks a LUKS volume and mount/unmount it in the given mount point."
+	printf 'Usage: %s [-c|--credentials-type <arg>] [-d|--device <arg>] [-m|--mount-point <arg>] [-a|--(no-)ask-pin] [-s|--salt <arg>] [-h|--help] <operation>\n' "$0"
+	printf '\t%s\n' "<operation>: Operation to perform (mount|umount)"
+	printf '\t%s\n' "-c, --credentials-type: Type of the credentials to use (external|embedded) (no default)"
+	printf '\t%s\n' "-d, --device: Name of the device to create (no default)"
+	printf '\t%s\n' "-m, --mount-point: Path of the mount point to use (no default)"
+	printf '\t%s\n' "-a, --ask-pin, --no-ask-pin: Ask for a pin (off by default)"
+	printf '\t%s\n' "-s, --salt: Salt to use (default: '""')"
+	printf '\t%s\n' "-h, --help: Prints help"
+}
+
+
+parse_commandline()
+{
+	_positionals_count=0
+	while test $# -gt 0
+	do
+		_key="$1"
+		case "$_key" in
+			-c|--credentials-type)
+				test $# -lt 2 && die "Missing value for the optional argument '$_key'." 1
+				_arg_credentials_type="$2"
+				shift
+				;;
+			--credentials-type=*)
+				_arg_credentials_type="${_key##--credentials-type=}"
+				;;
+			-c*)
+				_arg_credentials_type="${_key##-c}"
+				;;
+			-d|--device)
+				test $# -lt 2 && die "Missing value for the optional argument '$_key'." 1
+				_arg_device="$2"
+				shift
+				;;
+			--device=*)
+				_arg_device="${_key##--device=}"
+				;;
+			-d*)
+				_arg_device="${_key##-d}"
+				;;
+			-m|--mount-point)
+				test $# -lt 2 && die "Missing value for the optional argument '$_key'." 1
+				_arg_mount_point="$2"
+				shift
+				;;
+			--mount-point=*)
+				_arg_mount_point="${_key##--mount-point=}"
+				;;
+			-m*)
+				_arg_mount_point="${_key##-m}"
+				;;
+			-a|--no-ask-pin|--ask-pin)
+				_arg_ask_pin="on"
+				test "${1:0:5}" = "--no-" && _arg_ask_pin="off"
+				;;
+			-a*)
+				_arg_ask_pin="on"
+				_next="${_key##-a}"
+				if test -n "$_next" -a "$_next" != "$_key"
+				then
+					{ begins_with_short_option "$_next" && shift && set -- "-a" "-${_next}" "$@"; } || die "The short option '$_key' can't be decomposed to ${_key:0:2} and -${_key:2}, because ${_key:0:2} doesn't accept value and '-${_key:2:1}' doesn't correspond to a short option."
+				fi
+				;;
+			-s|--salt)
+				test $# -lt 2 && die "Missing value for the optional argument '$_key'." 1
+				_arg_salt="$2"
+				shift
+				;;
+			--salt=*)
+				_arg_salt="${_key##--salt=}"
+				;;
+			-s*)
+				_arg_salt="${_key##-s}"
+				;;
+			-h|--help)
+				print_help
+				exit 0
+				;;
+			-h*)
+				print_help
+				exit 0
+				;;
+			*)
+				_last_positional="$1"
+				_positionals+=("$_last_positional")
+				_positionals_count=$((_positionals_count + 1))
+				;;
+		esac
+		shift
+	done
+}
+
+
+handle_passed_args_count()
+{
+	local _required_args_string="'operation'"
+	test "${_positionals_count}" -ge 1 || _PRINT_HELP=yes die "FATAL ERROR: Not enough positional arguments - we require exactly 1 (namely: $_required_args_string), but got only ${_positionals_count}." 1
+	test "${_positionals_count}" -le 1 || _PRINT_HELP=yes die "FATAL ERROR: There were spurious positional arguments --- we expect exactly 1 (namely: $_required_args_string), but got ${_positionals_count} (the last one was: '${_last_positional}')." 1
+}
+
+
+assign_positional_args()
+{
+	local _positional_name _shift_for=$1
+	_positional_names="_arg_operation "
+
+	shift "$_shift_for"
+	for _positional_name in ${_positional_names}
+	do
+		test $# -gt 0 || break
+		eval "$_positional_name=\${1}" || die "Error during argument parsing, possibly an Argbash bug." 1
+		shift
+	done
+}
+
+parse_commandline "$@"
+handle_passed_args_count
+assign_positional_args 1 "${_positionals[@]}"
+
+# OTHER STUFF GENERATED BY Argbash
+
+### END OF CODE GENERATED BY Argbash (sortof) ### ])
+# [ <-- needed because of Argbash
+
+if [ -z ${_arg_mount_point} ]; then
+  die "Missing '--mount-point' argument"
+fi
+
+if [ -z ${_arg_device} ]; then
+  die "Missing '--device' argument"
+fi
+
+ASK_PIN=${_arg_ask_pin}
+OPERATION=${_arg_operation}
+DEVICE=${_arg_device}
+DEVICE_NAME=$(sed "s|/|_|g" <<< ${DEVICE})
+MOUNT_POINT=${_arg_mount_point}
+CREDENTIALS_TYPE=${_arg_credentials_type}
+SALT=${_arg_salt}
+CONF_FILE_PATH="/etc/fido2luksmounthelper.conf"
+
+if [ "${OPERATION}" == "mount" ]; then
+	if [ "${CREDENTIALS_TYPE}" == "external" ]; then
+    if  [ -f ${CONF_FILE_PATH} ]; then
+			if [ "${ASK_PIN}" == "on" ]; then
+				read PASSWORD
+			fi
+			CREDENTIALS=$(<${CONF_FILE_PATH})
+		else
+			die "The configuration file '${CONF_FILE_PATH}' is missing. Please create it or use embedded credentials."
+		fi
+		printf ${PASSWORD} | fido2luks open --salt string:${SALT} --pin --pin-source /dev/stdin ${DEVICE} ${DEVICE_NAME} ${CREDENTIALS}
+	elif [ "${CREDENTIALS_TYPE}" == "embedded" ]; then
+		if [ "${ASK_PIN}" == "on" ]; then
+			read PASSWORD
+		fi
+		printf ${PASSWORD} | fido2luks open-token --salt string:${SALT} --pin --pin-source /dev/stdin ${DEVICE} ${DEVICE_NAME}
+	else
+		die "Given credential-type '${CREDENTIALS_TYPE}' is invalid. It must be 'external' or 'embedded'"
+	fi 
+	mount /dev/mapper/${DEVICE_NAME} ${MOUNT_POINT}
+elif [ "${OPERATION}" == "umount" ]; then
+  umount ${MOUNT_POINT}
+  cryptsetup luksClose ${DEVICE_NAME}
+else
+  die "Given operation '${OPERATION}' is invalid. It must be 'mount' or 'unmount'"
+fi
+
+exit 0
+
+# ] <-- needed because of Argbash
--- a/src/cli.rs
+++ b/src/cli.rs
@ -1,121 +1,482 @@
 use crate::error::*;
+use crate::luks::{Fido2LuksToken, LuksDevice};
+use crate::util::sha256;
 use crate::*;
+use cli_args::*;

-use cryptsetup_rs as luks;
-use cryptsetup_rs::api::{CryptDeviceHandle, CryptDeviceOpenBuilder, Luks1Params};
-use cryptsetup_rs::Luks1CryptDevice;
-use ctap;
-use ctap::extensions::hmac::{FidoHmacCredential, HmacExtension};
-use ctap::FidoDevice;
+use structopt::clap::Shell;
+use structopt::StructOpt;
+
+use ctap::{FidoCredential, FidoErrorKind};

-use std::fs::File;
 use std::io::{Read, Write};
-use std::path::Path;
+use std::str::FromStr;
 use std::thread;
 use std::time::Duration;

-pub fn setup() -> Fido2LuksResult<()> {
-    while !authenticator_connected()? {
-        eprintln!("Please connect your authenticator");
-        for _ in 0..3 {
-            thread::sleep(Duration::from_secs(1));
-            if authenticator_connected()? {
-                break;
-            }
+use std::borrow::Cow;
+use std::collections::HashSet;
+use std::fs::File;
+use std::time::SystemTime;
+
+pub use cli_args::Args;
+
+fn read_pin(ap: &AuthenticatorParameters) -> Fido2LuksResult<String> {
+    if let Some(src) = ap.pin_source.as_ref() {
+        let mut pin = String::new();
+        File::open(src)?.read_to_string(&mut pin)?;
+        Ok(pin.trim_end_matches("\n").to_string()) //remove trailing newline
+    } else {
+        util::read_password("Authenticator PIN", false)
+    }
+}
+
+fn derive_secret(
+    credentials: &[HexEncoded],
+    salt: &[u8; 32],
+    timeout: u64,
+    pin: Option<&str>,
+) -> Fido2LuksResult<([u8; 32], FidoCredential)> {
+    let timeout = Duration::from_secs(timeout);
+    let start = SystemTime::now();
+
+    while let Ok(el) = start.elapsed() {
+        if el > timeout {
+            return Err(error::Fido2LuksError::NoAuthenticatorError);
        }
-    }
-
-    let mut config = Config::default();
-
-    let save_config = |c: &Config| {
-        File::create("fido2luks.json")
-            .expect("Failed to save config")
-            .write_all(serde_json::to_string_pretty(c).unwrap().as_bytes())
-            .expect("Failed to save config");
-    };
-
-    fn ask_bool(q: &str) -> bool {
-        ask_str(&format!("{} (y/n)", q)).expect("Failed to read from stdin") == "y"
-    }
-
-    println!("1. Generating a credential");
-    let mut ccred: Option<FidoHmacCredential> = None;
-    for di in ctap::get_devices().expect("Failed to query USB for 2fa devices") {
-        let mut dev = FidoDevice::new(&di).expect("Failed to open 2fa device");
-        match dev.make_hmac_credential() {
-            Ok(cred) => {
-                ccred = Some(cred);
-                break;
-            }
-            Err(_e) => println!("Failed to to obtain credential trying next device(if applicable)"),
-        }
-    }
-    config.credential_id = hex::encode(ccred.expect("No credential could be obtained").id);
-    save_config(&config);
-
-    loop {
-        let device = ask_str("Path to your luks device: ").expect("Failed to read from stdin");;
-        if Path::new(&device).exists()
-            || ask_bool(&format!("{} does not exist, save anyway?", device))
+        if get_devices()
+            .map(|devices| !devices.is_empty())
+            .unwrap_or(false)
        {
-            config.device = device.into();
            break;
        }
+        thread::sleep(Duration::from_millis(500));
    }

-    save_config(&config);
+    let credentials = credentials
+        .iter()
+        .map(|hex| FidoCredential {
+            id: hex.0.clone(),
+            public_key: None,
+        })
+        .collect::<Vec<_>>();
+    let credentials = credentials.iter().collect::<Vec<_>>();
+    let (unsalted, cred) =
+        perform_challenge(&credentials, salt, timeout - start.elapsed().unwrap(), pin)?;

-    config.mapper_name = ask_str("Name for decrypted disk: ").expect("Failed to read from stdin");;
-
-    save_config(&config);
-
-    println!("Config saved to: fido2luks.json");
-
-    //let slot = add_key_to_luks(&config).expect("Failed to add key to device");
-
-    //println!("Added key to slot: {}", slot);
-
-    Ok(())
+    Ok((sha256(&[salt, &unsalted[..]]), cred.clone()))
 }

-pub fn add_key_to_luks(device: PathBuf, secret: &[u8; 32]) -> Fido2LuksResult<u8> {
-    fn offer_format(
-        _dev: CryptDeviceOpenBuilder,
-    ) -> Fido2LuksResult<CryptDeviceHandle<Luks1Params>> {
-        unimplemented!()
+pub fn parse_cmdline() -> Args {
+    Args::from_args()
+}
+
+pub fn prompt_interaction(interactive: bool) {
+    if interactive {
+        println!("Authorize using your FIDO device");
    }
-    let dev =
-        || -> luks::device::Result<CryptDeviceOpenBuilder> { luks::open(&device.canonicalize()?) };
+}

-    let prev_key_info = rpassword::read_password_from_tty(Some(
-        "Please enter your current password or path to a keyfile in order to add a new key: ",
-    ))?;
-
-    let prev_key = match prev_key_info.as_ref() {
-        "" => None,
-        keyfile if PathBuf::from(keyfile).exists() => {
-            let mut f = File::open(keyfile)?;
-            let mut key = Vec::new();
-            f.read_to_end(&mut key)?;
-            Some(key)
+pub fn run_cli() -> Fido2LuksResult<()> {
+    let mut stdout = io::stdout();
+    let args = parse_cmdline();
+    let interactive = args.interactive;
+    match &args.command {
+        Command::Credential {
+            authenticator,
+            name,
+        } => {
+            let pin_string;
+            let pin = if authenticator.pin {
+                pin_string = read_pin(authenticator)?;
+                Some(pin_string.as_ref())
+            } else {
+                None
+            };
+            let cred = make_credential_id(Some(name.as_ref()), pin)?;
+            println!("{}", hex::encode(&cred.id));
+            Ok(())
        }
-        password => Some(Vec::from(password.as_bytes())),
-    };
+        Command::PrintSecret {
+            binary,
+            authenticator,
+            credentials,
+            secret,
+        } => {
+            let pin_string;
+            let pin = if authenticator.pin {
+                pin_string = read_pin(authenticator)?;
+                Some(pin_string.as_ref())
+            } else {
+                None
+            };
+            let salt = if interactive || secret.password_helper == PasswordHelper::Stdin {
+                util::read_password_hashed("Password", false)
+            } else {
+                secret.salt.obtain_sha256(&secret.password_helper)
+            }?;
+            prompt_interaction(interactive);
+            let (secret, _cred) = derive_secret(
+                credentials.ids.0.as_slice(),
+                &salt,
+                authenticator.await_time,
+                pin,
+            )?;
+            if *binary {
+                stdout.write_all(&secret[..])?;
+            } else {
+                stdout.write_all(hex::encode(&secret[..]).as_bytes())?;
+            }
+            Ok(stdout.flush()?)
+        }
+        Command::AddKey {
+            luks,
+            authenticator,
+            credentials,
+            secret,
+            luks_mod,
+            existing_secret: other_secret,
+            token,
+            ..
+        }
+        | Command::ReplaceKey {
+            luks,
+            authenticator,
+            credentials,
+            secret,
+            luks_mod,
+            replacement: other_secret,
+            token,
+            ..
+        } => {
+            let pin = if authenticator.pin {
+                Some(read_pin(authenticator)?)
+            } else {
+                None
+            };
+            let salt = |q: &str, verify: bool| -> Fido2LuksResult<[u8; 32]> {
+                if interactive || secret.password_helper == PasswordHelper::Stdin {
+                    util::read_password_hashed(q, verify)
+                } else {
+                    secret.salt.obtain_sha256(&secret.password_helper)
+                }
+            };
+            let other_secret = |salt_q: &str,
+                                verify: bool|
+             -> Fido2LuksResult<(Vec<u8>, Option<FidoCredential>)> {
+                match other_secret {
+                    OtherSecret {
+                        keyfile: Some(file),
+                        ..
+                    } => Ok((util::read_keyfile(file)?, None)),
+                    OtherSecret {
+                        fido_device: true, ..
+                    } => {
+                        prompt_interaction(interactive);
+                        Ok(derive_secret(
+                            &credentials.ids.0,
+                            &salt(salt_q, verify)?,
+                            authenticator.await_time,
+                            pin.as_deref(),
+                        )
+                        .map(|(secret, cred)| (secret[..].to_vec(), Some(cred)))?)
+                    }
+                    _ => Ok((
+                        util::read_password(salt_q, verify)?.as_bytes().to_vec(),
+                        None,
+                    )),
+                }
+            };
+            let secret = |q: &str, verify: bool| -> Fido2LuksResult<([u8; 32], FidoCredential)> {
+                prompt_interaction(interactive);
+                derive_secret(
+                    &credentials.ids.0,
+                    &salt(q, verify)?,
+                    authenticator.await_time,
+                    pin.as_deref(),
+                )
+            };
+            let mut luks_dev = LuksDevice::load(&luks.device)?;
+            // Non overlap
+            match &args.command {
+                Command::AddKey { exclusive, .. } => {
+                    let (existing_secret, _) = other_secret("Current password", false)?;
+                    let (new_secret, cred) = secret("Password to be added", true)?;
+                    let added_slot = luks_dev.add_key(
+                        &new_secret,
+                        &existing_secret[..],
+                        luks_mod.kdf_time.or(Some(10)),
+                        Some(&cred.id[..]).filter(|_| *token),
+                    )?;
+                    if *exclusive {
+                        let destroyed = luks_dev.remove_keyslots(&[added_slot])?;
+                        println!(
+                            "Added to key to device {}, slot: {}\nRemoved {} old keys",
+                            luks.device.display(),
+                            added_slot,
+                            destroyed
+                        );
+                    } else {
+                        println!(
+                            "Added to key to device {}, slot: {}",
+                            luks.device.display(),
+                            added_slot
+                        );
+                    }
+                    Ok(())
+                }
+                Command::ReplaceKey { add_password, .. } => {
+                    let (existing_secret, _) = secret("Current password", false)?;
+                    let (replacement_secret, cred) = other_secret("Replacement password", true)?;
+                    let slot = if *add_password {
+                        luks_dev.add_key(
+                            &replacement_secret[..],
+                            &existing_secret,
+                            luks_mod.kdf_time,
+                            cred.as_ref().filter(|_| *token).map(|cred| &cred.id[..]),
+                        )
+                    } else {
+                        luks_dev.replace_key(
+                            &replacement_secret[..],
+                            &existing_secret,
+                            luks_mod.kdf_time,
+                            cred.as_ref().filter(|_| *token).map(|cred| &cred.id[..]),
+                        )
+                    }?;
+                    println!(
+                        "Added to password to device {}, slot: {}",
+                        luks.device.display(),
+                        slot
+                    );
+                    Ok(())
+                }
+                _ => unreachable!(),
+            }
+        }
+        Command::Open {
+            luks,
+            authenticator,
+            secret,
+            name,
+            retries,
+            allow_discards,
+            ..
+        }
+        | Command::OpenToken {
+            luks,
+            authenticator,
+            secret,
+            name,
+            retries,
+            allow_discards,
+        } => {
+            let pin_string;
+            let pin = if authenticator.pin {
+                pin_string = read_pin(authenticator)?;
+                Some(pin_string.as_ref())
+            } else {
+                None
+            };
+            let salt = |q: &str, verify: bool| -> Fido2LuksResult<[u8; 32]> {
+                if interactive || secret.password_helper == PasswordHelper::Stdin {
+                    util::read_password_hashed(q, verify)
+                } else {
+                    secret.salt.obtain_sha256(&secret.password_helper)
+                }
+            };

-    let mut handle = match dev()?.luks1() {
-        Ok(handle) => handle,
-        Err(luks::device::Error::BlkidError(_)) => offer_format(dev()?)?,
-        Err(luks::device::Error::CryptsetupError(errno)) => {
-            //if i32::from(errno) == 555
-            dbg!(errno);
-            offer_format(dev()?)?
-        } //TODO: find correct errorno and offer to format as luks
-        err => err?,
-    };
-    let slot = handle.add_keyslot(secret, prev_key.as_ref().map(|b| b.as_slice()), None)?;
-    Ok(slot)
-}
+            // Cow shouldn't be necessary
+            let secret = |credentials: Cow<'_, Vec<HexEncoded>>| {
+                prompt_interaction(interactive);
+                derive_secret(
+                    credentials.as_ref(),
+                    &salt("Password", false)?,
+                    authenticator.await_time,
+                    pin,
+                )
+            };

-pub fn authenticator_connected() -> Fido2LuksResult<bool> {
-    Ok(!device::get_devices()?.is_empty())
+            let mut retries = *retries;
+            let mut luks_dev = LuksDevice::load(&luks.device)?;
+            loop {
+                let secret = match &args.command {
+                    Command::Open { credentials, .. } => secret(Cow::Borrowed(&credentials.ids.0))
+                        .and_then(|(secret, _cred)| {
+                            luks_dev.activate(&name, &secret, luks.slot, *allow_discards)
+                        }),
+                    Command::OpenToken { .. } => luks_dev.activate_token(
+                        &name,
+                        Box::new(|credentials: Vec<String>| {
+                            let creds = credentials
+                                .into_iter()
+                                .flat_map(|cred| HexEncoded::from_str(cred.as_ref()).ok())
+                                .collect::<Vec<_>>();
+                            secret(Cow::Owned(creds))
+                                .map(|(secret, cred)| (secret, hex::encode(&cred.id)))
+                        }),
+                        luks.slot,
+                        *allow_discards,
+                    ),
+                    _ => unreachable!(),
+                };
+                match secret {
+                    Err(e) => {
+                        match e {
+                            Fido2LuksError::WrongSecret if retries > 0 => {}
+                            Fido2LuksError::AuthenticatorError { ref cause }
+                                if cause.kind() == FidoErrorKind::Timeout && retries > 0 => {}
+
+                            e => return Err(e),
+                        }
+                        retries -= 1;
+                        eprintln!("{}", e);
+                    }
+                    res => break res.map(|_| ()),
+                }
+            }
+        }
+        Command::Connected => match get_devices() {
+            Ok(ref devs) if !devs.is_empty() => {
+                println!("Found {} devices", devs.len());
+                Ok(())
+            }
+            _ => exit(1),
+        },
+        Command::Token(cmd) => match cmd {
+            TokenCommand::List {
+                device,
+                csv: dump_credentials,
+            } => {
+                let mut dev = LuksDevice::load(device)?;
+                let mut creds = Vec::new();
+                for token in dev.tokens()? {
+                    let (id, token) = token?;
+                    for cred in token.credential.iter() {
+                        if !creds.contains(cred) {
+                            creds.push(cred.clone());
+                            if *dump_credentials {
+                                print!("{}{}", if creds.len() == 1 { "" } else { "," }, cred);
+                            }
+                        }
+                    }
+                    if *dump_credentials {
+                        continue;
+                    }
+                    println!(
+                        "{}:\n\tSlots: {}\n\tCredentials: {}",
+                        id,
+                        if token.keyslots.is_empty() {
+                            "None".into()
+                        } else {
+                            token.keyslots.iter().cloned().collect::<Vec<_>>().join(",")
+                        },
+                        token
+                            .credential
+                            .iter()
+                            .map(|cred| format!(
+                                "{} ({})",
+                                cred,
+                                creds.iter().position(|c| c == cred).unwrap().to_string()
+                            ))
+                            .collect::<Vec<_>>()
+                            .join(",")
+                    );
+                }
+                if *dump_credentials {
+                    println!();
+                }
+                Ok(())
+            }
+            TokenCommand::Add {
+                device,
+                credentials,
+                slot,
+            } => {
+                let mut dev = LuksDevice::load(device)?;
+                let mut tokens = Vec::new();
+                for token in dev.tokens()? {
+                    let (id, token) = token?;
+                    if token.keyslots.contains(&slot.to_string()) {
+                        tokens.push((id, token));
+                    }
+                }
+                let count = if tokens.is_empty() {
+                    dev.add_token(&Fido2LuksToken::with_credentials(&credentials.ids.0, *slot))?;
+                    1
+                } else {
+                    tokens.len()
+                };
+                for (id, mut token) in tokens {
+                    token
+                        .credential
+                        .extend(credentials.ids.0.iter().map(|h| h.to_string()));
+                    dev.update_token(id, &token)?;
+                }
+                println!("Updated {} tokens", count);
+                Ok(())
+            }
+            TokenCommand::Remove {
+                device,
+                credentials,
+                token_id,
+            } => {
+                let mut dev = LuksDevice::load(device)?;
+                let mut tokens = Vec::new();
+                for token in dev.tokens()? {
+                    let (id, token) = token?;
+                    if let Some(token_id) = token_id {
+                        if id == *token_id {
+                            tokens.push((id, token));
+                        }
+                    } else {
+                        tokens.push((id, token));
+                    }
+                }
+                let count = tokens.len();
+                for (id, mut token) in tokens {
+                    token.credential = token
+                        .credential
+                        .into_iter()
+                        .filter(|cred| !credentials.ids.0.iter().any(|h| &h.to_string() == cred))
+                        .collect();
+                    dev.update_token(id, &token)?;
+                }
+                println!("Updated {} tokens", count);
+                Ok(())
+            }
+            TokenCommand::GC { device } => {
+                let mut dev = LuksDevice::load(device)?;
+                let mut creds: HashSet<String> = HashSet::new();
+                let mut remove = Vec::new();
+                for token in dev.tokens()? {
+                    let (id, token) = token?;
+                    if token.keyslots.is_empty() || token.credential.is_empty() {
+                        creds.extend(token.credential);
+                        remove.push(id);
+                    }
+                }
+                for id in remove.iter().rev() {
+                    dev.remove_token(*id)?;
+                }
+                println!(
+                    "Removed {} tokens, affected credentials: {}",
+                    remove.len(),
+                    creds.into_iter().collect::<Vec<_>>().join(",")
+                );
+                Ok(())
+            }
+        },
+        Command::GenerateCompletions { shell, out_dir } => {
+            Args::clap().gen_completions(
+                env!("CARGO_PKG_NAME"),
+                match shell.as_ref() {
+                    "bash" => Shell::Bash,
+                    "fish" => Shell::Fish,
+                    _ => unreachable!("structopt shouldn't allow us to reach this point"),
+                },
+                &out_dir,
+            );
+            Ok(())
+        }
+    }
 }
--- a/src/cli_args/config.rs
+++ b/src/cli_args/config.rs
@ -0,0 +1,209 @@
+use crate::error::*;
+use crate::*;
+use ring::digest;
+
+use std::fmt;
+use std::fs::File;
+use std::io::Read;
+use std::path::PathBuf;
+use std::process::Command;
+use std::str::FromStr;
+
+#[derive(Debug, Clone, PartialEq)]
+pub enum SecretInput {
+    AskPassword,
+    String(String),
+    File { path: PathBuf },
+}
+
+impl Default for SecretInput {
+    fn default() -> Self {
+        SecretInput::AskPassword
+    }
+}
+
+impl From<&str> for SecretInput {
+    fn from(s: &str) -> Self {
+        let mut parts = s.split(':');
+        match parts.next() {
+            Some("ask") | Some("Ask") => SecretInput::AskPassword,
+            Some("file") => SecretInput::File {
+                path: parts.collect::<Vec<_>>().join(":").into(),
+            },
+            Some("string") => SecretInput::String(parts.collect::<Vec<_>>().join(":")),
+            _ => Self::default(),
+        }
+    }
+}
+
+impl FromStr for SecretInput {
+    type Err = Fido2LuksError;
+
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        Ok(Self::from(s))
+    }
+}
+
+impl fmt::Display for SecretInput {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> Result<(), fmt::Error> {
+        f.write_str(&match self {
+            SecretInput::AskPassword => "ask".to_string(),
+            SecretInput::String(s) => ["string", s].join(":"),
+            SecretInput::File { path } => ["file", path.display().to_string().as_str()].join(":"),
+        })
+    }
+}
+
+impl SecretInput {
+    pub fn obtain_string(&self, password_helper: &PasswordHelper) -> Fido2LuksResult<String> {
+        Ok(String::from_utf8(self.obtain(password_helper)?)?)
+    }
+
+    pub fn obtain(&self, password_helper: &PasswordHelper) -> Fido2LuksResult<Vec<u8>> {
+        let mut secret = Vec::new();
+        match self {
+            SecretInput::File { path } => {
+                //TODO: replace with try_blocks
+                let mut do_io = || File::open(path)?.read_to_end(&mut secret);
+                do_io().map_err(|cause| Fido2LuksError::KeyfileError { cause })?;
+            }
+            SecretInput::AskPassword => {
+                secret.extend_from_slice(password_helper.obtain()?.as_bytes())
+            }
+
+            SecretInput::String(s) => secret.extend_from_slice(s.as_bytes()),
+        }
+        Ok(secret)
+    }
+
+    pub fn obtain_sha256(&self, password_helper: &PasswordHelper) -> Fido2LuksResult<[u8; 32]> {
+        let mut digest = digest::Context::new(&digest::SHA256);
+        match self {
+            SecretInput::File { path } => {
+                let mut do_io = || {
+                    let mut reader = File::open(path)?;
+                    let mut buf = [0u8; 512];
+                    loop {
+                        let red = reader.read(&mut buf)?;
+                        digest.update(&buf[0..red]);
+                        if red == 0 {
+                            break;
+                        }
+                    }
+                    Ok(())
+                };
+                do_io().map_err(|cause| Fido2LuksError::KeyfileError { cause })?;
+            }
+            _ => digest.update(self.obtain(password_helper)?.as_slice()),
+        }
+        let mut salt = [0u8; 32];
+        salt.as_mut().copy_from_slice(digest.finish().as_ref());
+        Ok(salt)
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum PasswordHelper {
+    Script(String),
+    #[allow(dead_code)]
+    Systemd,
+    Stdin,
+}
+
+impl Default for PasswordHelper {
+    fn default() -> Self {
+        PasswordHelper::Script(
+            "/usr/bin/env systemd-ask-password 'Please enter second factor for LUKS disk encryption!'"
+                .into(),
+        )
+    }
+}
+
+impl From<&str> for PasswordHelper {
+    fn from(s: &str) -> Self {
+        match s {
+            "stdin" => PasswordHelper::Stdin,
+            s => PasswordHelper::Script(s.into()),
+        }
+    }
+}
+
+impl FromStr for PasswordHelper {
+    type Err = Fido2LuksError;
+
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        Ok(Self::from(s))
+    }
+}
+
+impl fmt::Display for PasswordHelper {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> Result<(), fmt::Error> {
+        f.write_str(&match self {
+            PasswordHelper::Stdin => "stdin".to_string(),
+            PasswordHelper::Systemd => "systemd".to_string(),
+            PasswordHelper::Script(path) => path.clone(),
+        })
+    }
+}
+
+impl PasswordHelper {
+    pub fn obtain(&self) -> Fido2LuksResult<String> {
+        use PasswordHelper::*;
+        match self {
+            Systemd => unimplemented!(),
+            Stdin => Ok(util::read_password("Password", true)?),
+            Script(password_helper) => {
+                let password = Command::new("sh")
+                    .arg("-c")
+                    .arg(&password_helper)
+                    .output()
+                    .map_err(|e| Fido2LuksError::AskPassError {
+                        cause: error::AskPassError::IO(e),
+                    })?
+                    .stdout;
+                Ok(String::from_utf8(password)?.trim().to_owned())
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+mod test {
+
+    use super::*;
+
+    #[test]
+    fn input_salt_from_str() {
+        assert_eq!(
+            "file:/tmp/abc".parse::<SecretInput>().unwrap(),
+            SecretInput::File {
+                path: "/tmp/abc".into()
+            }
+        );
+        assert_eq!(
+            "string:abc".parse::<SecretInput>().unwrap(),
+            SecretInput::String("abc".into())
+        );
+        assert_eq!(
+            "ask".parse::<SecretInput>().unwrap(),
+            SecretInput::AskPassword
+        );
+        assert_eq!(
+            "lol".parse::<SecretInput>().unwrap(),
+            SecretInput::default()
+        );
+    }
+
+    #[test]
+    fn input_salt_obtain() {
+        assert_eq!(
+            SecretInput::String("abc".into())
+                .obtain_sha256(&PasswordHelper::Stdin)
+                .unwrap(),
+            [
+                186, 120, 22, 191, 143, 1, 207, 234, 65, 65, 64, 222, 93, 174, 34, 35, 176, 3, 97,
+                163, 150, 23, 122, 156, 180, 16, 255, 97, 242, 0, 21, 173
+            ]
+        )
+    }
+}
--- a/src/cli_args/mod.rs
+++ b/src/cli_args/mod.rs
@ -0,0 +1,299 @@
+use std::fmt::{Display, Error, Formatter};
+use std::path::PathBuf;
+use std::str::FromStr;
+use structopt::clap::AppSettings;
+use structopt::StructOpt;
+
+mod config;
+
+pub use config::*;
+
+#[derive(Debug, Eq, PartialEq, Clone)]
+pub struct HexEncoded(pub Vec<u8>);
+
+impl Display for HexEncoded {
+    fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error> {
+        f.write_str(&hex::encode(&self.0))
+    }
+}
+
+impl AsRef<[u8]> for HexEncoded {
+    fn as_ref(&self) -> &[u8] {
+        &self.0[..]
+    }
+}
+
+impl FromStr for HexEncoded {
+    type Err = hex::FromHexError;
+
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        Ok(HexEncoded(hex::decode(s)?))
+    }
+}
+
+#[derive(Debug, Eq, PartialEq, Clone)]
+pub struct CommaSeparated<T: FromStr + Display>(pub Vec<T>);
+
+impl<T: Display + FromStr> Display for CommaSeparated<T> {
+    fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error> {
+        for i in &self.0 {
+            f.write_str(&i.to_string())?;
+            f.write_str(",")?;
+        }
+        Ok(())
+    }
+}
+
+impl<T: Display + FromStr> FromStr for CommaSeparated<T> {
+    type Err = <T as FromStr>::Err;
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        Ok(CommaSeparated(
+            s.split(',')
+                .map(|part| <T as FromStr>::from_str(part))
+                .collect::<Result<Vec<_>, _>>()?,
+        ))
+    }
+}
+
+#[derive(Debug, StructOpt)]
+pub struct Credentials {
+    /// FIDO credential ids, separated by ',' generate using fido2luks credential
+    #[structopt(name = "credential-id", env = "FIDO2LUKS_CREDENTIAL_ID")]
+    pub ids: CommaSeparated<HexEncoded>,
+}
+
+#[derive(Debug, StructOpt)]
+pub struct AuthenticatorParameters {
+    /// Request a PIN to unlock the authenticator
+    #[structopt(short = "P", long = "pin")]
+    pub pin: bool,
+
+    /// Location to read PIN from
+    #[structopt(long = "pin-source", env = "FIDO2LUKS_PIN_SOURCE")]
+    pub pin_source: Option<PathBuf>,
+
+    /// Await for an authenticator to be connected, timeout after n seconds
+    #[structopt(
+        long = "await-dev",
+        name = "await-dev",
+        env = "FIDO2LUKS_DEVICE_AWAIT",
+        default_value = "15"
+    )]
+    pub await_time: u64,
+}
+
+#[derive(Debug, StructOpt)]
+pub struct LuksParameters {
+    #[structopt(env = "FIDO2LUKS_DEVICE")]
+    pub device: PathBuf,
+
+    /// Try to unlock the device using a specifc keyslot, ignore all other slots
+    #[structopt(long = "slot", env = "FIDO2LUKS_DEVICE_SLOT")]
+    pub slot: Option<u32>,
+}
+
+#[derive(Debug, StructOpt, Clone)]
+pub struct LuksModParameters {
+    /// Number of milliseconds required to derive the volume decryption key
+    /// Defaults to 10ms when using an authenticator or the default by cryptsetup when using a password
+    #[structopt(long = "kdf-time", name = "kdf-time")]
+    pub kdf_time: Option<u64>,
+}
+
+#[derive(Debug, StructOpt)]
+pub struct SecretParameters {
+    /// Salt for secret generation, defaults to 'ask'
+    ///
+    /// Options:{n}
+    ///  - ask              : Prompt user using password helper{n}
+    ///  - file:<PATH>      : Will read <FILE>{n}
+    ///  - string:<STRING>  : Will use <STRING>, which will be handled like a password provided to the 'ask' option{n}
+    #[structopt(
+        name = "salt",
+        long = "salt",
+        env = "FIDO2LUKS_SALT",
+        default_value = "ask"
+    )]
+    pub salt: SecretInput,
+    /// Script used to obtain passwords, overridden by --interactive flag
+    #[structopt(
+        name = "password-helper",
+        env = "FIDO2LUKS_PASSWORD_HELPER",
+        default_value = "/usr/bin/env systemd-ask-password 'Please enter second factor for LUKS disk encryption!'"
+    )]
+    pub password_helper: PasswordHelper,
+}
+#[derive(Debug, StructOpt)]
+pub struct Args {
+    /// Request passwords via Stdin instead of using the password helper
+    #[structopt(short = "i", long = "interactive")]
+    pub interactive: bool,
+    #[structopt(subcommand)]
+    pub command: Command,
+}
+
+#[derive(Debug, StructOpt, Clone)]
+pub struct OtherSecret {
+    /// Use a keyfile instead of a password
+    #[structopt(short = "d", long = "keyfile", conflicts_with = "fido_device")]
+    pub keyfile: Option<PathBuf>,
+    /// Use another fido device instead of a password
+    /// Note: this requires for the credential fot the other device to be passed as argument as well
+    #[structopt(short = "f", long = "fido-device", conflicts_with = "keyfile")]
+    pub fido_device: bool,
+}
+
+#[derive(Debug, StructOpt)]
+pub enum Command {
+    #[structopt(name = "print-secret")]
+    PrintSecret {
+        /// Prints the secret as binary instead of hex encoded
+        #[structopt(short = "b", long = "bin")]
+        binary: bool,
+        #[structopt(flatten)]
+        credentials: Credentials,
+        #[structopt(flatten)]
+        authenticator: AuthenticatorParameters,
+        #[structopt(flatten)]
+        secret: SecretParameters,
+    },
+    /// Adds a generated key to the specified LUKS device
+    #[structopt(name = "add-key")]
+    AddKey {
+        #[structopt(flatten)]
+        luks: LuksParameters,
+        #[structopt(flatten)]
+        credentials: Credentials,
+        #[structopt(flatten)]
+        authenticator: AuthenticatorParameters,
+        #[structopt(flatten)]
+        secret: SecretParameters,
+        /// Will wipe all other keys
+        #[structopt(short = "e", long = "exclusive")]
+        exclusive: bool,
+        /// Will add an token to your LUKS 2 header, including the credential id
+        #[structopt(short = "t", long = "token")]
+        token: bool,
+        #[structopt(flatten)]
+        existing_secret: OtherSecret,
+        #[structopt(flatten)]
+        luks_mod: LuksModParameters,
+    },
+    /// Replace a previously added key with a password
+    #[structopt(name = "replace-key")]
+    ReplaceKey {
+        #[structopt(flatten)]
+        luks: LuksParameters,
+        #[structopt(flatten)]
+        credentials: Credentials,
+        #[structopt(flatten)]
+        authenticator: AuthenticatorParameters,
+        #[structopt(flatten)]
+        secret: SecretParameters,
+        /// Add the password and keep the key
+        #[structopt(short = "a", long = "add-password")]
+        add_password: bool,
+        /// Will add an token to your LUKS 2 header, including the credential id
+        #[structopt(short = "t", long = "token")]
+        token: bool,
+        #[structopt(flatten)]
+        replacement: OtherSecret,
+        #[structopt(flatten)]
+        luks_mod: LuksModParameters,
+    },
+    /// Open the LUKS device
+    #[structopt(name = "open")]
+    Open {
+        #[structopt(flatten)]
+        luks: LuksParameters,
+        #[structopt(env = "FIDO2LUKS_MAPPER_NAME")]
+        name: String,
+        #[structopt(flatten)]
+        credentials: Credentials,
+        #[structopt(flatten)]
+        authenticator: AuthenticatorParameters,
+        #[structopt(flatten)]
+        secret: SecretParameters,
+        #[structopt(short = "r", long = "max-retries", default_value = "0")]
+        retries: i32,
+        /// Pass SSD trim instructions to the underlying block device
+        #[structopt(long = "allow-discards")]
+        allow_discards: bool,
+    },
+    /// Open the LUKS device using credentials embedded in the LUKS 2 header
+    #[structopt(name = "open-token")]
+    OpenToken {
+        #[structopt(flatten)]
+        luks: LuksParameters,
+        #[structopt(env = "FIDO2LUKS_MAPPER_NAME")]
+        name: String,
+        #[structopt(flatten)]
+        authenticator: AuthenticatorParameters,
+        #[structopt(flatten)]
+        secret: SecretParameters,
+        #[structopt(short = "r", long = "max-retries", default_value = "0")]
+        retries: i32,
+        /// Pass SSD trim instructions to the underlying block device
+        #[structopt(long = "allow-discards")]
+        allow_discards: bool,
+    },
+    /// Generate a new FIDO credential
+    #[structopt(name = "credential")]
+    Credential {
+        #[structopt(flatten)]
+        authenticator: AuthenticatorParameters,
+        /// Name to be displayed on the authenticator display
+        #[structopt(env = "FIDO2LUKS_CREDENTIAL_NAME", default_value = "fido2luks")]
+        name: String,
+    },
+    /// Check if an authenticator is connected
+    #[structopt(name = "connected")]
+    Connected,
+    Token(TokenCommand),
+    /// Generate bash completion scripts
+    #[structopt(name = "completions", setting = AppSettings::Hidden)]
+    GenerateCompletions {
+        /// Shell to generate completions for: bash, fish
+        #[structopt(possible_values = &["bash", "fish"])]
+        shell: String,
+        out_dir: PathBuf,
+    },
+}
+
+///LUKS2 token related operations
+#[derive(Debug, StructOpt)]
+pub enum TokenCommand {
+    /// List all tokens associated with the specified device
+    List {
+        #[structopt(env = "FIDO2LUKS_DEVICE")]
+        device: PathBuf,
+        /// Dump all credentials as CSV
+        #[structopt(long = "csv")]
+        csv: bool,
+    },
+    /// Add credential to a keyslot
+    Add {
+        #[structopt(env = "FIDO2LUKS_DEVICE")]
+        device: PathBuf,
+        #[structopt(flatten)]
+        credentials: Credentials,
+        /// Slot to which the credentials will be added
+        #[structopt(long = "slot", env = "FIDO2LUKS_DEVICE_SLOT")]
+        slot: u32,
+    },
+    /// Remove credentials from token(s)
+    Remove {
+        #[structopt(env = "FIDO2LUKS_DEVICE")]
+        device: PathBuf,
+        #[structopt(flatten)]
+        credentials: Credentials,
+        /// Token from which the credentials will be removed
+        #[structopt(long = "token")]
+        token_id: Option<u32>,
+    },
+    /// Remove all unassigned tokens
+    GC {
+        #[structopt(env = "FIDO2LUKS_DEVICE")]
+        device: PathBuf,
+    },
+}
--- a/src/config.rs
+++ b/src/config.rs
@ -1,183 +0,0 @@
-use crate::error::*;
-use crate::*;
-use crypto::digest::Digest;
-use crypto::sha2::Sha256;
-
-use serde_derive::{Deserialize, Serialize};
-use std::collections::HashMap;
-use std::convert::TryInto;
-use std::env;
-use std::fs::File;
-use std::io::Read;
-use std::path::{Path, PathBuf};
-use std::process::Command;
-
-#[derive(Debug, Deserialize, Serialize)]
-pub struct EnvConfig {
-    pub credential_id: String,
-    pub device: Option<String>,
-    pub salt: String,
-    pub mapper_name: Option<String>,
-    pub password_helper: String,
-}
-
-impl TryInto<Config> for EnvConfig {
-    type Error = Fido2LuksError;
-
-    fn try_into(self) -> Fido2LuksResult<Config> {
-        Ok(Config {
-            credential_id: self.credential_id,
-            device: self
-                .device
-                .ok_or(Fido2LuksError::ConfigurationError {
-                    cause: ConfigurationError::MissingField("DEVICE".into()),
-                })?
-                .into(),
-            mapper_name: self.mapper_name.ok_or(Fido2LuksError::ConfigurationError {
-                cause: ConfigurationError::MissingField("DEVICE_MAPPER".into()),
-            })?,
-            password_helper: PasswordHelper::Script(self.password_helper),
-            input_salt: self.salt.as_str().into(),
-        })
-    }
-}
-
-#[derive(Debug, Deserialize, Serialize)]
-pub struct Config {
-    pub credential_id: String,
-    pub input_salt: InputSalt,
-    pub device: PathBuf,
-    pub mapper_name: String,
-    pub password_helper: PasswordHelper,
-}
-
-impl Config {
-    pub fn load_default_location() -> Fido2LuksResult<Config> {
-        Self::load_config(
-            &mut File::open(
-                env::vars()
-                    .collect::<HashMap<_, _>>()
-                    .get("FIDO2LUKS_CONFIG")
-                    .unwrap_or(&"/etc/fido2luks.json".to_owned()),
-            )
-            .or(File::open("fido2luks.json"))?,
-        )
-    }
-
-    pub fn load_config(reader: &mut dyn Read) -> Fido2LuksResult<Config> {
-        let mut conf_str = String::new();
-        reader.read_to_string(&mut conf_str)?;
-
-        Ok(serde_json::from_str(&conf_str)?)
-    }
-}
-
-impl Default for Config {
-    fn default() -> Self {
-        Config {
-            credential_id: "<required>".into(),
-            input_salt: Default::default(),
-            device: "/dev/some-vg/<volume>".into(),
-            mapper_name: "2fa-secured-luks".into(),
-            password_helper: PasswordHelper::default(),
-        }
-    }
-}
-
-#[derive(Debug, Deserialize, Serialize)]
-pub enum InputSalt {
-    AskPassword,
-    File { path: PathBuf },
-    Both { path: PathBuf },
-}
-
-impl Default for InputSalt {
-    fn default() -> Self {
-        InputSalt::AskPassword
-    }
-}
-
-impl From<&str> for InputSalt {
-    fn from(s: &str) -> Self {
-        if PathBuf::from(s).exists() && s != "Ask" {
-            InputSalt::File { path: s.into() }
-        } else {
-            InputSalt::AskPassword
-        }
-    }
-}
-
-impl InputSalt {
-    pub fn obtain(&self, password_helper: &PasswordHelper) -> Fido2LuksResult<[u8; 32]> {
-        let mut digest = Sha256::new();
-        match self {
-            InputSalt::File { path } => {
-                let mut do_io = || {
-                    let mut reader = File::open(path)?;
-                    let mut buf = [0u8; 512];
-                    loop {
-                        let red = reader.read(&mut buf)?;
-                        digest.input(&buf[0..red]);
-                        if red == 0 {
-                            break;
-                        }
-                    }
-                    Ok(())
-                };
-                do_io().map_err(|cause| Fido2LuksError::KeyfileError { cause })?;
-            }
-            InputSalt::AskPassword => {
-                digest.input(password_helper.obtain()?.as_bytes());
-            }
-            InputSalt::Both { path } => {
-                digest.input(&InputSalt::AskPassword.obtain(password_helper)?);
-                digest.input(&InputSalt::File { path: path.clone() }.obtain(password_helper)?)
-            }
-        }
-        let mut salt = [0u8; 32];
-        digest.result(&mut salt);
-        Ok(salt)
-    }
-}
-
-#[derive(Debug, Deserialize, Serialize)]
-pub enum PasswordHelper {
-    Script(String),
-    Systemd,
-    Stdin,
-}
-
-impl Default for PasswordHelper {
-    fn default() -> Self {
-        PasswordHelper::Script("/usr/bin/systemd-ask-password --no-tty 'Please enter second factor for LUKS disk encryption!'".into())
-    }
-}
-
-impl From<&str> for PasswordHelper {
-    fn from(s: &str) -> Self {
-        match s {
-            "stdin" => PasswordHelper::Stdin,
-            s => PasswordHelper::Script(s.into()),
-        }
-    }
-}
-
-impl PasswordHelper {
-    pub fn obtain(&self) -> Fido2LuksResult<String> {
-        use PasswordHelper::*;
-        match self {
-            Systemd => unimplemented!(),
-            Stdin => Ok(rpassword::read_password_from_tty(Some("Password: "))?),
-            Script(password_helper) => {
-                let mut helper_parts = password_helper.split(" ");
-
-                let password = Command::new((&mut helper_parts).next().unwrap())
-                    .args(helper_parts)
-                    .output()
-                    .map_err(|e| Fido2LuksError::AskPassError { cause: e })?
-                    .stdout;
-                Ok(String::from_utf8(password)?.trim().to_owned())
-            }
-        }
-    }
-}
--- a/src/device.rs
+++ b/src/device.rs
@ -1,51 +1,61 @@
 use crate::error::*;

-use ctap;
-use ctap::extensions::hmac::{FidoHmacCredential, HmacExtension};
-use ctap::{FidoDevice, FidoError, FidoErrorKind};
+use crate::util;
+use ctap::{
+    self, extensions::hmac::HmacExtension, request_multiple_devices, FidoAssertionRequestBuilder,
+    FidoCredential, FidoCredentialRequestBuilder, FidoDevice, FidoError, FidoErrorKind,
+};
+use std::time::Duration;

-pub fn make_credential_id() -> Fido2LuksResult<FidoHmacCredential> {
-    let mut errs = Vec::new();
-    match get_devices()? {
-        ref devs if devs.is_empty() => Err(Fido2LuksError::NoAuthenticatorError)?,
-        devs => {
-            for mut dev in devs.into_iter() {
-                match dev.make_hmac_credential() {
-                    Ok(cred) => {
-                        return Ok(cred);
-                    }
-                    Err(e) => {
-                        errs.push(e);
-                    }
-                }
-            }
-        }
+const RP_ID: &str = "fido2luks";
+
+pub fn make_credential_id(
+    name: Option<&str>,
+    pin: Option<&str>,
+) -> Fido2LuksResult<FidoCredential> {
+    let mut request = FidoCredentialRequestBuilder::default().rp_id(RP_ID);
+    if let Some(user_name) = name {
+        request = request.user_name(user_name);
    }
-    Err(errs.pop().ok_or(Fido2LuksError::NoAuthenticatorError)?)?
+    let request = request.build().unwrap();
+    let make_credential = |device: &mut FidoDevice| {
+        if let Some(pin) = pin {
+            device.unlock(pin)?;
+        }
+        device.make_hmac_credential(&request)
+    };
+    Ok(request_multiple_devices(
+        get_devices()?
+            .iter_mut()
+            .map(|device| (device, &make_credential)),
+        None,
+    )?)
 }

-pub fn perform_challenge(credential_id: &str, salt: &[u8; 32]) -> Fido2LuksResult<[u8; 32]> {
-    let cred = FidoHmacCredential {
-        id: hex::decode(credential_id).unwrap(),
-        rp_id: "hmac".to_string(),
-    };
-    let mut errs = Vec::new();
-    match get_devices()? {
-        ref devs if devs.is_empty() => Err(Fido2LuksError::NoAuthenticatorError)?,
-        devs => {
-            for mut dev in devs.into_iter() {
-                match dev.hmac_challange(&cred, &salt[..]) {
-                    Ok(secret) => {
-                        return Ok(secret);
-                    }
-                    Err(e) => {
-                        errs.push(e);
-                    }
-                }
-            }
+pub fn perform_challenge<'a>(
+    credentials: &'a [&'a FidoCredential],
+    salt: &[u8; 32],
+    timeout: Duration,
+    pin: Option<&str>,
+) -> Fido2LuksResult<([u8; 32], &'a FidoCredential)> {
+    let request = FidoAssertionRequestBuilder::default()
+        .rp_id(RP_ID)
+        .credentials(credentials)
+        .build()
+        .unwrap();
+    let get_assertion = |device: &mut FidoDevice| {
+        if let Some(pin) = pin {
+            device.unlock(pin)?;
        }
-    }
-    Err(errs.pop().ok_or(Fido2LuksError::NoAuthenticatorError)?)?
+        device.get_hmac_assertion(&request, &util::sha256(&[&salt[..]]), None)
+    };
+    let (credential, (secret, _)) = request_multiple_devices(
+        get_devices()?
+            .iter_mut()
+            .map(|device| (device, &get_assertion)),
+        Some(timeout),
+    )?;
+    Ok((secret, credential))
 }

 pub fn get_devices() -> Fido2LuksResult<Vec<FidoDevice>> {
@ -54,7 +64,7 @@ pub fn get_devices() -> Fido2LuksResult<Vec<FidoDevice>> {
        match FidoDevice::new(&di) {
            Err(e) => match e.kind() {
                FidoErrorKind::ParseCtap | FidoErrorKind::DeviceUnsupported => (),
-                err => Err(FidoError::from(err))?,
+                err => return Err(FidoError::from(err).into()),
            },
            Ok(dev) => devices.push(dev),
        }
--- a/src/error.rs
+++ b/src/error.rs
@ -1,55 +1,89 @@
 use ctap::FidoError;
+use libcryptsetup_rs::LibcryptErr;
 use std::io;
+use std::io::ErrorKind;
+use std::string::FromUtf8Error;
+use Fido2LuksError::*;

 pub type Fido2LuksResult<T> = Result<T, Fido2LuksError>;

 #[derive(Debug, Fail)]
 pub enum Fido2LuksError {
    #[fail(display = "unable to retrieve password: {}", cause)]
-    AskPassError { cause: io::Error },
+    AskPassError { cause: AskPassError },
    #[fail(display = "unable to read keyfile: {}", cause)]
    KeyfileError { cause: io::Error },
    #[fail(display = "authenticator error: {}", cause)]
    AuthenticatorError { cause: ctap::FidoError },
-    #[fail(display = "no authenticator found, please ensure you device is plugged in")]
+    #[fail(display = "no authenticator found, please ensure your device is plugged in")]
    NoAuthenticatorError,
-    #[fail(display = "luks err")]
-    LuksError { cause: cryptsetup_rs::device::Error },
-    #[fail(display = "no authenticator found, please ensure you device is plugged in")]
+    #[fail(display = " {}", cause)]
+    CryptsetupError {
+        cause: libcryptsetup_rs::LibcryptErr,
+    },
+    #[fail(display = "{}", cause)]
+    LuksError { cause: LuksError },
+    #[fail(display = "{}", cause)]
    IoError { cause: io::Error },
-    #[fail(display = "failed to parse config, please check formatting and contents")]
-    ConfigurationError { cause: ConfigurationError },
-    #[fail(display = "the submitted secret is not applicable to this luks device")]
+    #[fail(display = "supplied secret isn't valid for this device")]
    WrongSecret,
    #[fail(display = "not an utf8 string")]
    StringEncodingError { cause: FromUtf8Error },
 }

-#[derive(Debug)]
-pub enum ConfigurationError {
-    Json(serde_json::error::Error),
-    Env(envy::Error),
-    MissingField(String),
-}
-
-impl From<serde_json::error::Error> for Fido2LuksError {
-    fn from(e: serde_json::error::Error) -> Self {
-        Fido2LuksError::ConfigurationError {
-            cause: ConfigurationError::Json(e),
+impl Fido2LuksError {
+    pub fn exit_code(&self) -> i32 {
+        use Fido2LuksError::*;
+        match self {
+            AskPassError { .. } | KeyfileError { .. } => 2,
+            AuthenticatorError { .. } => 3,
+            NoAuthenticatorError => 4,
+            WrongSecret => 5,
+            _ => 1,
        }
    }
 }

-impl From<envy::Error> for Fido2LuksError {
-    fn from(e: envy::Error) -> Self {
-        Fido2LuksError::ConfigurationError {
-            cause: ConfigurationError::Env(e),
+#[derive(Debug, Fail)]
+pub enum AskPassError {
+    #[fail(display = "unable to retrieve password: {}", _0)]
+    IO(io::Error),
+    #[fail(display = "provided passwords don't match")]
+    Mismatch,
+}
+
+#[derive(Debug, Fail)]
+pub enum LuksError {
+    #[fail(display = "This feature requires to the LUKS device to be formatted as LUKS 2")]
+    Luks2Required,
+    #[fail(display = "Invalid token: {}", _0)]
+    InvalidToken(String),
+    #[fail(display = "No token found")]
+    NoToken,
+    #[fail(display = "The device already exists")]
+    DeviceExists,
+}
+
+impl LuksError {
+    pub fn activate(e: LibcryptErr) -> Fido2LuksError {
+        match e {
+            LibcryptErr::IOError(ref io) => match io.raw_os_error() {
+                Some(1) if io.kind() == ErrorKind::PermissionDenied => Fido2LuksError::WrongSecret,
+                Some(17) => Fido2LuksError::LuksError {
+                    cause: LuksError::DeviceExists,
+                },
+                _ => return Fido2LuksError::CryptsetupError { cause: e },
+            },
+            _ => Fido2LuksError::CryptsetupError { cause: e },
        }
    }
 }

-use std::string::FromUtf8Error;
-use Fido2LuksError::*;
+impl From<LuksError> for Fido2LuksError {
+    fn from(e: LuksError) -> Self {
+        Fido2LuksError::LuksError { cause: e }
+    }
+}

 impl From<FidoError> for Fido2LuksError {
    fn from(e: FidoError) -> Self {
@ -57,12 +91,16 @@ impl From<FidoError> for Fido2LuksError {
    }
 }

-impl From<cryptsetup_rs::device::Error> for Fido2LuksError {
-    fn from(e: cryptsetup_rs::device::Error) -> Self {
-        LuksError { cause: e }
+impl From<LibcryptErr> for Fido2LuksError {
+    fn from(e: LibcryptErr) -> Self {
+        match e {
+            LibcryptErr::IOError(e) if e.raw_os_error().iter().any(|code| code == &1i32) => {
+                WrongSecret
+            }
+            _ => CryptsetupError { cause: e },
+        }
    }
 }
-
 impl From<io::Error> for Fido2LuksError {
    fn from(e: io::Error) -> Self {
        IoError { cause: e }
--- a/src/keystore.rs
+++ b/src/keystore.rs
@ -1,17 +0,0 @@
-use keyutils::Keyring;
-
-fn get_passphrase() -> Vec<u8> {
-    Keyring::request("user")
-        .unwrap()
-        .request_key("fido2luks")
-        .unwrap()
-        .read()
-        .unwrap()
-}
-
-fn add_secret(secret: &[u8]) {
-    Keyring::request("session")
-        .unwrap()
-        .add_key("cryptsetup", secret)
-        .unwrap();
-}
--- a/src/luks.rs
+++ b/src/luks.rs
@ -0,0 +1,333 @@
+use crate::error::*;
+
+use libcryptsetup_rs::{
+    CryptActivateFlag, CryptActivateFlags, CryptDevice, CryptInit, CryptTokenInfo,
+    EncryptionFormat, KeyslotInfo, TokenInput,
+};
+use std::collections::{HashMap, HashSet};
+use std::path::Path;
+
+pub struct LuksDevice {
+    device: CryptDevice,
+    luks2: Option<bool>,
+}
+
+impl LuksDevice {
+    pub fn load<P: AsRef<Path>>(path: P) -> Fido2LuksResult<LuksDevice> {
+        let mut device = CryptInit::init(path.as_ref())?;
+        device.context_handle().load::<()>(None, None)?;
+        Ok(Self {
+            device,
+            luks2: None,
+        })
+    }
+
+    pub fn is_luks2(&mut self) -> Fido2LuksResult<bool> {
+        if let Some(luks2) = self.luks2 {
+            Ok(luks2)
+        } else {
+            self.luks2 = Some(match self.device.format_handle().get_type()? {
+                EncryptionFormat::Luks2 => true,
+                _ => false,
+            });
+            self.is_luks2()
+        }
+    }
+
+    fn require_luks2(&mut self) -> Fido2LuksResult<()> {
+        if !self.is_luks2()? {
+            return Err(LuksError::Luks2Required.into());
+        }
+        Ok(())
+    }
+
+    pub fn tokens<'a>(
+        &'a mut self,
+    ) -> Fido2LuksResult<Box<dyn Iterator<Item = Fido2LuksResult<(u32, Fido2LuksToken)>> + 'a>>
+    {
+        self.require_luks2()?;
+        Ok(Box::new(
+            (0..32)
+                .map(move |i| {
+                    let status = match self.device.token_handle().status(i) {
+                        Ok(status) => status,
+                        Err(err) => return Some(Err(Fido2LuksError::from(err))),
+                    };
+                    match status {
+                        CryptTokenInfo::Inactive => return None,
+                        CryptTokenInfo::Internal(s)
+                        | CryptTokenInfo::InternalUnknown(s)
+                        | CryptTokenInfo::ExternalUnknown(s)
+                        | CryptTokenInfo::External(s)
+                            if &s != Fido2LuksToken::default_type() =>
+                        {
+                            return None
+                        }
+                        _ => (),
+                    };
+                    let json = match self.device.token_handle().json_get(i) {
+                        Ok(json) => json,
+                        Err(err) => return Some(Err(Fido2LuksError::from(err))),
+                    };
+                    let info: Fido2LuksToken =
+                        match serde_json::from_value(json.clone()).map_err(|_| {
+                            Fido2LuksError::LuksError {
+                                cause: LuksError::InvalidToken(json.to_string()),
+                            }
+                        }) {
+                            Ok(info) => info,
+                            Err(err) => return Some(Err(Fido2LuksError::from(err))),
+                        };
+                    Some(Ok((i, info)))
+                })
+                .filter_map(|o| o),
+        ))
+    }
+
+    pub fn find_token(&mut self, slot: u32) -> Fido2LuksResult<Option<(u32, Fido2LuksToken)>> {
+        let slot_str = slot.to_string();
+        for token in self.tokens()? {
+            let (id, token) = token?;
+            if token.keyslots.contains(&slot_str) {
+                return Ok(Some((id, token)));
+            }
+        }
+        Ok(None)
+    }
+
+    pub fn add_token(&mut self, data: &Fido2LuksToken) -> Fido2LuksResult<()> {
+        self.require_luks2()?;
+        self.device
+            .token_handle()
+            .json_set(TokenInput::AddToken(&serde_json::to_value(&data).unwrap()))?;
+        Ok(())
+    }
+
+    pub fn remove_token(&mut self, token: u32) -> Fido2LuksResult<()> {
+        self.require_luks2()?;
+        self.device
+            .token_handle()
+            .json_set(TokenInput::RemoveToken(token))?;
+        Ok(())
+    }
+
+    pub fn update_token(&mut self, token: u32, data: &Fido2LuksToken) -> Fido2LuksResult<()> {
+        self.require_luks2()?;
+        self.device
+            .token_handle()
+            .json_set(TokenInput::ReplaceToken(
+                token,
+                &serde_json::to_value(&data).unwrap(),
+            ))?;
+        Ok(())
+    }
+
+    pub fn add_key(
+        &mut self,
+        secret: &[u8],
+        old_secret: &[u8],
+        iteration_time: Option<u64>,
+        credential_id: Option<&[u8]>,
+    ) -> Fido2LuksResult<u32> {
+        if let Some(millis) = iteration_time {
+            self.device.settings_handle().set_iteration_time(millis)
+        }
+        let slot = self
+            .device
+            .keyslot_handle()
+            .add_by_passphrase(None, old_secret, secret)?;
+        if let Some(id) = credential_id {
+            self.device.token_handle().json_set(TokenInput::AddToken(
+                &serde_json::to_value(&Fido2LuksToken::new(id, slot)).unwrap(),
+            ))?;
+        }
+
+        Ok(slot)
+    }
+
+    pub fn remove_keyslots(&mut self, exclude: &[u32]) -> Fido2LuksResult<u32> {
+        let mut destroyed = 0;
+        let mut tokens = Vec::new();
+        for slot in 0..256 {
+            match self.device.keyslot_handle().status(slot)? {
+                KeyslotInfo::Inactive => continue,
+                KeyslotInfo::Active | KeyslotInfo::ActiveLast if !exclude.contains(&slot) => {
+                    if self.is_luks2()? {
+                        if let Some((id, _token)) = self.find_token(slot)? {
+                            tokens.push(id);
+                        }
+                    }
+                    self.device.keyslot_handle().destroy(slot)?;
+                    destroyed += 1;
+                }
+                KeyslotInfo::ActiveLast => break,
+                _ => (),
+            }
+            if self.device.keyslot_handle().status(slot)? == KeyslotInfo::ActiveLast {
+                break;
+            }
+        }
+        // Ensure indices stay valid
+        tokens.sort();
+        for token in tokens.iter().rev() {
+            self.remove_token(*token)?;
+        }
+        Ok(destroyed)
+    }
+
+    pub fn replace_key(
+        &mut self,
+        secret: &[u8],
+        old_secret: &[u8],
+        iteration_time: Option<u64>,
+        credential_id: Option<&[u8]>,
+    ) -> Fido2LuksResult<u32> {
+        if let Some(millis) = iteration_time {
+            self.device.settings_handle().set_iteration_time(millis)
+        }
+        // Use activate dry-run to locate keyslot
+        let slot = self.device.activate_handle().activate_by_passphrase(
+            None,
+            None,
+            old_secret,
+            CryptActivateFlags::empty(),
+        )?;
+        self.device.keyslot_handle().change_by_passphrase(
+            Some(slot),
+            Some(slot),
+            old_secret,
+            secret,
+        )? as u32;
+        if let Some(id) = credential_id {
+            if self.is_luks2()? {
+                let token = self.find_token(slot)?.map(|(t, _)| t);
+                let json = serde_json::to_value(&Fido2LuksToken::new(id, slot)).unwrap();
+                if let Some(token) = token {
+                    self.device
+                        .token_handle()
+                        .json_set(TokenInput::ReplaceToken(token, &json))?;
+                } else {
+                    self.device
+                        .token_handle()
+                        .json_set(TokenInput::AddToken(&json))?;
+                }
+            }
+        }
+        Ok(slot)
+    }
+
+    pub fn activate(
+        &mut self,
+        name: &str,
+        secret: &[u8],
+        slot_hint: Option<u32>,
+        allow_discard: bool,
+    ) -> Fido2LuksResult<u32> {
+        let mut flags = CryptActivateFlags::empty();
+        if allow_discard {
+            flags = CryptActivateFlags::new(vec![CryptActivateFlag::AllowDiscards]);
+        }
+        self.device
+            .activate_handle()
+            .activate_by_passphrase(Some(name), slot_hint, secret, flags)
+            .map_err(LuksError::activate)
+    }
+
+    pub fn activate_token(
+        &mut self,
+        name: &str,
+        secret: impl Fn(Vec<String>) -> Fido2LuksResult<([u8; 32], String)>,
+        slot_hint: Option<u32>,
+        allow_discard: bool,
+    ) -> Fido2LuksResult<u32> {
+        if !self.is_luks2()? {
+            return Err(LuksError::Luks2Required.into());
+        }
+        let mut creds: HashMap<String, HashSet<u32>> = HashMap::new();
+        for token in self.tokens()? {
+            let token = match token {
+                Ok((_id, t)) => t,
+                _ => continue, // An corrupted token should't lock the user out
+            };
+            let slots = || {
+                token
+                    .keyslots
+                    .iter()
+                    .filter_map(|slot| slot.parse::<u32>().ok())
+            };
+            for cred in token.credential.iter() {
+                creds
+                    .entry(cred.clone())
+                    .or_insert_with(|| slots().collect::<HashSet<u32>>())
+                    .extend(slots());
+            }
+        }
+        if creds.is_empty() {
+            return Err(Fido2LuksError::LuksError {
+                cause: LuksError::NoToken,
+            });
+        }
+        let (secret, credential) = secret(creds.keys().cloned().collect())?;
+        let empty;
+        let slots = if let Some(slots) = creds.get(&credential) {
+            slots
+        } else {
+            empty = HashSet::new();
+            &empty
+        };
+        //Try slots associated with the credential used
+        let slots = slots.iter().cloned().map(Option::Some).chain(
+            std::iter::once(slot_hint) // Try slot hint if there is one
+                .take(slot_hint.is_some() as usize)
+                .chain(std::iter::once(None).take(slots.is_empty() as usize)), // Try all slots as last resort
+        );
+        for slot in slots {
+            match self.activate(name, &secret, slot, allow_discard) {
+                Err(Fido2LuksError::WrongSecret) => (),
+                res => return res,
+            }
+        }
+        Err(Fido2LuksError::WrongSecret)
+    }
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Fido2LuksToken {
+    #[serde(rename = "type")]
+    pub type_: String,
+    pub credential: HashSet<String>,
+    pub keyslots: HashSet<String>,
+}
+
+impl Fido2LuksToken {
+    pub fn new(credential_id: impl AsRef<[u8]>, slot: u32) -> Self {
+        Self::with_credentials(std::iter::once(credential_id), slot)
+    }
+
+    pub fn with_credentials<I: IntoIterator<Item = B>, B: AsRef<[u8]>>(
+        credentials: I,
+        slot: u32,
+    ) -> Self {
+        Self {
+            credential: credentials
+                .into_iter()
+                .map(|cred| hex::encode(cred.as_ref()))
+                .collect(),
+            keyslots: vec![slot.to_string()].into_iter().collect(),
+            ..Default::default()
+        }
+    }
+    pub fn default_type() -> &'static str {
+        "fido2luks"
+    }
+}
+
+impl Default for Fido2LuksToken {
+    fn default() -> Self {
+        Self {
+            type_: Self::default_type().into(),
+            credential: HashSet::new(),
+            keyslots: HashSet::new(),
+        }
+    }
+}
--- a/src/main.rs
+++ b/src/main.rs
@ -1,220 +1,27 @@
 #[macro_use]
 extern crate failure;
+extern crate ctap_hmac as ctap;
+#[macro_use]
 extern crate serde_derive;
 use crate::cli::*;
-use crate::config::*;
 use crate::device::*;
 use crate::error::*;
-use crypto::digest::Digest;
-use crypto::sha2::Sha256;
-use cryptsetup_rs as luks;
-
-use cryptsetup_rs::Luks1CryptDevice;
-use ctap;
-
-use luks::device::Error::CryptsetupError;
-
-use std::collections::HashMap;
-use std::env;
-
-use std::convert::TryInto;
-use std::io::{self, stdout, Write};
-use std::path::PathBuf;
+use std::io;
 use std::process::exit;

 mod cli;
-mod config;
+pub mod cli_args;
 mod device;
 mod error;
-mod keystore;
-
-fn open_container(device: &PathBuf, name: &str, secret: &[u8; 32]) -> Fido2LuksResult<()> {
-    let mut handle = luks::open(device.canonicalize()?)?.luks1()?;
-    let _slot = handle.activate(name, &secret[..])?;
-    Ok(())
-}
-
-fn assemble_secret(hmac_result: &[u8], salt: &[u8]) -> [u8; 32] {
-    let mut digest = Sha256::new();
-    digest.input(salt);
-    digest.input(hmac_result);
-    let mut secret = [0u8; 32];
-    digest.result(&mut secret);
-    secret
-}
-fn ask_str(q: &str) -> Fido2LuksResult<String> {
-    let stdin = io::stdin();
-    let mut s = String::new();
-    print!("{}", q);
-    io::stdout().flush()?;
-    stdin.read_line(&mut s)?;
-    Ok(s.trim().to_owned())
-}
-
-fn open(conf: &Config, secret: &[u8; 32]) -> Fido2LuksResult<()> {
-    dbg!(hex::encode(&secret));
-    match open_container(&conf.device, &conf.mapper_name, &secret) {
-        Err(Fido2LuksError::LuksError {
-            cause: CryptsetupError(errno),
-        }) if errno.0 == 1 => Err(Fido2LuksError::WrongSecret)?,
-        e => e?,
-    };
-    Ok(())
-}
-
-/*fn package_self() -> Fido2LuksResult<()> {
-    let conf = Config::load_default_location()?;
-    let binary_path: PathBuf = env::args().next().unwrap().into();
-    let mut me = File::open(binary_path)?;
-
-    me.seek(io::SeekFrom::End(("config".as_bytes().len() * -1) as i64 - 4))?;
-
-    let conf_len = me.read_u32()?;
-
-    let mut buf = vec![0u8; 512];
-
-    me.read(&mut buf[0..6])?;
-
-    if String::from_utf8((&buf[0..6]).iter().collect()).map(|s| &s == "config").unwrap_or(false) {
-
-    }
-
-    Ok(())
-}*/
+mod luks;
+mod util;

 fn main() -> Fido2LuksResult<()> {
-    let args: Vec<_> = env::args().skip(1).collect();
-    fn config_env() -> Fido2LuksResult<EnvConfig> {
-        Ok(envy::prefixed("FIDO2LUKS_").from_env::<EnvConfig>()?)
-    }
-    fn secret_from_env_config(conf: &EnvConfig) -> Fido2LuksResult<[u8; 32]> {
-        let conf = config_env()?;
-        let salt =
-            InputSalt::from(conf.salt.as_str()).obtain(&conf.password_helper.as_str().into())?;
-        Ok(assemble_secret(
-            &perform_challenge(&conf.credential_id, &salt)?,
-            &salt,
-        ))
-    }
-    match &args.iter().map(|s| s.as_str()).collect::<Vec<_>>()[..] {
-        ["print-secret"] => {
-            let conf = config_env()?;
-            io::stdout().write(hex::encode(&secret_from_env_config(&conf)?[..]).as_bytes())?;
-            Ok(io::stdout().flush()?)
-        }
-        ["open"] => {
-            let mut conf = config_env()?;
-            open_container(
-                &conf
-                    .device
-                    .as_ref()
-                    .expect("please specify FIDO2LUKS_DEVICE")
-                    .into(),
-                &conf
-                    .mapper_name
-                    .as_ref()
-                    .expect("please specify FIDO2LUKS_MAPPER_NAME"),
-                &secret_from_env_config(&conf)?,
-            )
-        }
-        ["open", device, mapper_name] => {
-            let mut conf = config_env()?;
-            conf.mapper_name = Some(mapper_name.to_string());
-            conf.device = Some(device.to_string());
-            open_container(
-                &conf
-                    .device
-                    .as_ref()
-                    .expect("please specify FIDO2LUKS_DEVICE")
-                    .into(),
-                &conf
-                    .mapper_name
-                    .as_ref()
-                    .expect("please specify FIDO2LUKS_MAPPER_NAME"),
-                &secret_from_env_config(&conf)?,
-            )
-        }
-        ["credential"] => {
-            let cred = make_credential_id()?;
-            println!("{}", hex::encode(&cred.id));
-            Ok(())
-        }
-        ["addkey", device] => {
-            let mut conf = config_env()?;
-            conf.device = conf.device.or(Some(device.to_string()));
-            let slot = add_key_to_luks(
-                conf.device.as_ref().unwrap().into(),
-                &secret_from_env_config(&conf)?,
-            )?;
-            println!("Added to key to device {}, slot: {}", device, slot);
-            Ok(())
-        }
-        _ => {
-            println!(
-                "Usage:\n
-            fido2luks open <device> [name]\n
-            fido2luks addkey <device>\n\n
-            Environment variables:\n
-            <FIDO2LUKS_CREDENTIAL_ID>\n
-            <FIDO2LUKS_SALT>\n
-            "
-            );
-            Ok(())
-        }
-    }
-}
-
-fn main_old() -> Fido2LuksResult<()> {
-    let args: Vec<_> = env::args().skip(1).collect(); //Ignore program name -> Vec
-    let env = env::vars().collect::<HashMap<_, _>>();
-    let secret = |conf: &Config| -> Fido2LuksResult<[u8; 32]> {
-        let salt = conf.input_salt.obtain(&conf.password_helper)?;
-
-        Ok(assemble_secret(
-            &perform_challenge(&conf.credential_id, &salt)?,
-            &salt,
-        ))
-    };
-    if args.is_empty() {
-        let conf = Config::load_default_location()?;
-        if env.contains_key("CRYPTTAB_NAME") {
-            //Indicates that this script is being run as keyscript
-            let mut out = stdout();
-            out.write(&secret(&conf)?)?;
-            Ok(out.flush()?)
-        } else {
-            io::stdout().write(&secret(&conf)?)?;
-            Ok(io::stdout().flush()?)
-        }
-    } else {
-        match args.first().map(|s| s.as_ref()).unwrap() {
-            //"addkey" => add_key_to_luks(&Config::load_default_location()?).map(|_| ()),
-            "setup" => setup(),
-            "open" if args.get(1).map(|a| &*a == "-e").unwrap_or(false) => {
-                let conf = envy::prefixed("FIDO2LUKS_")
-                    .from_env::<EnvConfig>()
-                    .expect("Missing env config values")
-                    .try_into()?;
-                open(&conf, &secret(&conf)?)
-            }
-            "open" => open(
-                &Config::load_default_location()?,
-                &secret(&Config::load_default_location()?)?,
-            ),
-            "connected" => match authenticator_connected()? {
-                false => {
-                    println!("no");
-                    exit(1)
-                }
-                _ => {
-                    println!("yes");
-                    exit(0)
-                }
-            },
-            _ => {
-                eprintln!("Usage: setup | addkey | connected");
-                Ok(())
-            } //"selfcontain" => package_self()
+    match run_cli() {
+        Err(e) => {
+            eprintln!("{:?}", e);
+            exit(e.exit_code())
        }
+        _ => exit(0),
    }
 }
--- a/src/util.rs
+++ b/src/util.rs
@ -0,0 +1,41 @@
+use crate::error::*;
+use ring::digest;
+use std::fs::File;
+use std::io::Read;
+use std::path::PathBuf;
+
+pub fn sha256(messages: &[&[u8]]) -> [u8; 32] {
+    let mut digest = digest::Context::new(&digest::SHA256);
+    for m in messages.iter() {
+        digest.update(m);
+    }
+    let mut secret = [0u8; 32];
+    secret.as_mut().copy_from_slice(digest.finish().as_ref());
+    secret
+}
+
+pub fn read_password(q: &str, verify: bool) -> Fido2LuksResult<String> {
+    match rpassword::read_password_from_tty(Some(&[q, ": "].join("")))? {
+        ref pass
+            if verify
+                && &rpassword::read_password_from_tty(Some(&[q, "(again): "].join(" ")))?
+                    != pass =>
+        {
+            Err(Fido2LuksError::AskPassError {
+                cause: AskPassError::Mismatch,
+            })
+        }
+        pass => Ok(pass),
+    }
+}
+
+pub fn read_password_hashed(q: &str, verify: bool) -> Fido2LuksResult<[u8; 32]> {
+    read_password(q, verify).map(|pass| sha256(&[pass.as_bytes()]))
+}
+
+pub fn read_keyfile<P: Into<PathBuf>>(path: P) -> Fido2LuksResult<Vec<u8>> {
+    let mut file = File::open(path.into())?;
+    let mut key = Vec::new();
+    file.read_to_end(&mut key)?;
+    Ok(key)
+}
Author	SHA1	Message	Date
shimun	210da1ce0f	added --allow-discards flag	2021-12-28 13:35:34 +01:00
shimun	4509cacd6d	update deps	2021-12-28 13:32:29 +01:00
cbachert	67136f2405	Add Ubuntu fallback to passphrase, add defaults (#35 ) Co-authored-by: cbachert <1316659-cbachert@users.noreply.gitlab.com>	2021-09-11 16:33:14 +02:00
shimun	b2e4950db5	update ctap_hmac	2021-07-26 18:46:10 +02:00
shimun	5496c4e61b	always set credential name	2021-07-14 15:47:23 +02:00
shimun	51fa26b7d5	bump version	2021-07-14 12:24:58 +02:00
Vyacheslav Konovalov	a3696962e8	Support for initcpio (#31 ) * Add initcpio hook and install script * Make PIN optional * Add README for initcpio * Fix PKGBUILD, add install of initcpio * Fix README for initcpio	2021-07-14 12:23:32 +02:00
shimunn	7e6b33ae7f	Theory of operation (#30 ) All checks were successful continuous-integration/drone/push Build is passing Details	2021-02-28 12:56:57 +01:00
shimun	b3495c45f3	add nix flake	2021-02-08 16:06:56 +01:00
shimunn	17ca487b85	Obvious password promt (#29 ) * obvious password promt * prompt interaction with FIDO device	2021-02-08 15:58:41 +01:00
shimun	b0404f2fc1	minimum YubiKey firmware version Some checks reported errors continuous-integration/drone/push Build encountered an error Details	2020-11-17 13:05:45 +01:00
shimunn	de21e3ef8d	Merge pull request #21 from aacebedo/master Added an helper script to be used with pam_mount	2020-11-01 21:18:13 +01:00
Alexandre ACEBEDO	8a7b3addbb	Added an helper script to be used with pam_mount	2020-11-01 18:21:04 +01:00
shimun	e7e44cd61b	fix test All checks were successful continuous-integration/drone/push Build is passing Details	2020-10-13 14:17:22 +02:00
shimun	0ec859f4a6	remove trailing newline from pin Some checks failed continuous-integration/drone/push Build is failing Details	2020-09-25 12:40:34 +02:00
shimun	55bae4161e	add credentials situated in the luks header to credential list Some checks failed continuous-integration/drone/push Build is failing Details	2020-09-19 18:23:21 +02:00
shimun	086c1a0594	file path must be relative to src Some checks failed continuous-integration/drone/push Build is failing Details	2020-09-05 19:35:36 +02:00
shimun	c2e38eb06f	generate shell completions during build Some checks failed continuous-integration/drone/push Build is failing Details continuous-integration/drone/tag Build is failing Details	2020-09-05 18:52:07 +02:00
shimun	03ef5721e0	bump version All checks were successful continuous-integration/drone/tag Build is passing Details continuous-integration/drone/push Build is passing Details	2020-09-03 14:56:36 +02:00
shimun	008e644024	auto detect current version	2020-09-03 14:56:22 +02:00
shimun	e1f762ddc9	add subcommand to generate bash completions All checks were successful continuous-integration/drone/push Build is passing Details	2020-09-03 14:45:52 +02:00
Saravanan Palanisamy	2266754a95	create PKGBUILD file for archlinux package (#17 ) Some checks reported errors continuous-integration/drone/push Build encountered an error Details * create PKGBUILD file * use build & install method * add package dependencies	2020-09-02 14:14:40 +02:00
shimun	8811cff6d1	0.2.12 All checks were successful continuous-integration/drone/tag Build is passing Details	2020-08-31 00:04:24 +02:00
shimun	99787b614c	Merge branch 'pin_source' into master Some checks reported errors continuous-integration/drone/push Build encountered an error Details	2020-08-31 00:00:42 +02:00
shimun	ee28f87148	always print the full error message All checks were successful continuous-integration/drone/push Build is passing Details	2020-08-30 17:09:57 +02:00
shimun	196356fe3b	structopt does not allow for flags to be linked to env atm	2020-08-25 21:47:25 +02:00
shimun	3ff7e698bd	add flag to read pin from alternate source Some checks reported errors continuous-integration/drone/push Build encountered an error Details	2020-08-25 21:26:30 +02:00
shimun	04d0d60fb3	use ubuntu as base image Some checks reported errors continuous-integration/drone/tag Build is passing Details continuous-integration/drone/push Build was killed Details	2020-08-16 15:30:20 +02:00
shimun	e64f777c54	use sh to run password helper	2020-08-16 13:42:54 +02:00
shimun	8465949b44	spell promPt correctly	2020-08-16 13:42:35 +02:00
shimunn	06bed03e7b	Merge pull request #13 from Andrew-Finn/master Added documentation and tweaked readme	2020-08-14 12:40:02 +02:00
Andrew-Finn	36f82e7c3a	Added and edited documentation	2020-08-14 11:36:25 +01:00
shimun	cd90564f60	protect fido2luks.conf from being overwritten Some checks failed continuous-integration/drone/push Build is failing Details continuous-integration/drone/tag Build is failing Details	2020-08-11 23:08:12 +02:00
shimun	0f6d79a7e4	get plymouth to display a message Some checks failed continuous-integration/drone/push Build is failing Details	2020-08-11 22:41:21 +02:00
shimun	4136b1bfad	relicense to MPL Some checks failed continuous-integration/drone/push Build is failing Details	2020-07-27 09:22:02 +02:00
shimun	81016a1a42	require MPL for new contributions Some checks failed continuous-integration/drone/push Build is failing Details	2020-07-26 21:11:03 +02:00
shimun	840868468b	cargo-deb meta All checks were successful continuous-integration/drone/push Build is passing Details	2020-07-04 21:32:21 +02:00
shimun	97880e4f41	refuse removal while crypttab depends on keyscript All checks were successful continuous-integration/drone/push Build is passing Details	2020-07-03 16:21:35 +02:00
shimun	e798ba5c70	remove keyscript aswell All checks were successful continuous-integration/drone/push Build is passing Details	2020-07-03 15:59:12 +02:00
shimun	298e05fed7	initramfs-tools All checks were successful continuous-integration/drone/push Build is passing Details	2020-07-03 15:55:23 +02:00
shimun	a498e1416f	automate cargo publish Some checks failed continuous-integration/drone/push Build is passing Details continuous-integration/drone/tag Build is failing Details	2020-06-23 23:55:07 +02:00
shimun	92e413de50	refactored luks operations All checks were successful continuous-integration/drone/push Build is passing Details	2020-06-22 20:47:19 +00:00
shimun	023399bb14	use unstable cryptsetup Some checks failed continuous-integration/drone/push Build is failing Details	2020-06-22 18:17:10 +02:00
shimun	a53a430c23	update drone Some checks failed continuous-integration/drone/push Build is failing Details	2020-06-21 22:16:45 +02:00
shimun	5f107cd337	add non existing token Some checks failed continuous-integration/drone/push Build is failing Details	2020-06-19 20:09:36 +02:00
shimun	ddfd24a098	ensure replace_key uses the same slot	2020-06-19 20:05:05 +02:00
shimun	743edf668a	document --token	2020-06-13 14:35:46 +02:00
shimun	4507107fac	update libcryptsetup-rs	2020-06-10 13:50:28 +02:00
shimun	a8482c50a2	handle tokens when replacing	2020-06-08 19:22:19 +02:00
shimun	09be5ef551	assemble secret in correct order	2020-06-08 18:08:24 +02:00
shimun	6f6c84ddba	skip luks2 check until underlying issue is fixed	2020-06-07 14:14:51 +02:00
shimun	5a05cad695	more precise description	2020-06-06 23:39:23 +02:00
shimun	d8d24b40f5	Merge branch 'cli_reorg'	2020-06-06 23:37:22 +02:00
shimun	c1a82b9ae6	update libcryptsetup_rs to 0.4.0	2020-06-06 22:43:18 +02:00
shimun	a26b79bcd6	reduced redundant code	2020-05-05 23:53:50 +02:00
shimun	f774580c9c	update to current api	2020-05-05 23:28:44 +02:00
shimun	69732a1ad6	restore order	2020-04-29 20:33:28 +02:00
shimun	b8ae9d91f0	rudimentary pin support	2020-04-29 19:56:18 +02:00
shimun	fcdd2a2d3d	add option to specify keyslot	2020-04-29 18:55:25 +02:00
shimun	c3d6425e2d	reorganised cli	2020-04-29 18:50:55 +02:00
shimun	0b19760175	hint slots	2020-04-28 19:09:53 +02:00
shimun	2ec8679c47	open token	2020-04-28 14:27:14 +02:00
shimun	65e1dead8b	remove token	2020-04-27 22:07:00 +02:00
shimun	478fb5e036	store luks token	2020-04-27 19:26:21 +02:00
shimun	1547f5e199	get format	2020-04-27 18:12:06 +02:00
shimun	5c0364587e	update ctap	2020-04-26 18:58:37 +02:00
shimun	9307503bdc	applied clippy lints	2020-04-07 20:06:24 +02:00
shimun	b94f45d1ff	patch secret_gen before obtaing first secret	2020-04-06 23:33:41 +02:00
shimun	c8fb636846	mention clang build dependency	2020-04-06 22:52:15 +02:00
shimun	49e2835f60	enable fido requests to be sent to multiple devices at once	2020-04-06 21:38:11 +02:00
shimun	d5c0d48f03	allow another fido device to be used as previous secret	2020-04-06 20:18:00 +02:00
shimun	ad2451f548	add timeout	2020-04-05 23:24:18 +02:00
shimun	bb7ee7c1ce	request password only once if possible	2020-04-03 22:02:05 +02:00
shimun	0ba77963d2	update ctap_hmac	2020-04-02 17:22:15 +02:00
shimun	1658800553	request_multiple	2020-04-01 20:24:49 +02:00
shimun	a394b7d1d1	libcryptsetup-rs patch	2020-03-28 14:54:36 +01:00
shimun	c99d7f562d	support luks2	2020-03-27 20:08:54 +01:00
shimun	c4f781e6e3	only process keyslots within a given range	2020-03-27 20:03:42 +01:00
shimun	f6de4a033e	more detailed messages	2020-03-27 18:28:33 +01:00
shimun	f5880346b9	switch to libcryptsetup-rs	2020-03-27 18:09:38 +01:00
shimun	6089b254b4	switch to libcryptsetup-rs for luks2 support	2020-03-22 17:39:44 +01:00
shimun	03e34ec790	0.2.3 Some checks failed continuous-integration/drone/push Build is passing Details continuous-integration/drone/tag Build is failing Details	2020-01-20 22:43:06 +01:00
shimun	a437106fcb	use await-dev per default All checks were successful continuous-integration/drone/push Build is passing Details	2020-01-16 19:41:59 +01:00
shimun	7ed948d53b	update & tidy readme All checks were successful continuous-integration/drone/push Build is passing Details	2020-01-15 16:46:15 +01:00
shimun	c4e08413c0	Added --await-dev flag All checks were successful continuous-integration/drone/push Build is passing Details	2020-01-13 23:23:45 +01:00
shimunn	7429706920	Merge pull request #7 from mmahut/patch-1 All checks were successful continuous-integration/drone/push Build is passing Details error.rs: typo	2020-01-13 21:54:09 +01:00
Marek Mahut	a5fd5fa9f6	error.rs: typo	2020-01-13 17:44:51 +01:00
shimun	659fafdfb4	update to 0.2.2 Some checks failed continuous-integration/drone/push Build is passing Details continuous-integration/drone/tag Build is failing Details	2020-01-10 21:44:33 +01:00
shimun	7f2668eded	allow for named credentials	2020-01-10 21:32:39 +01:00
shimunn	ae714cdef3	Merge pull request #6 from mmahut/fixid All checks were successful continuous-integration/drone/push Build is passing Details match rp_id to fido2luks	2020-01-10 19:47:31 +01:00
shimunn	ae802e5e71	Merge pull request #5 from mmahut/env use password helper in modified environments	2020-01-10 19:47:01 +01:00
Marek Mahut	a5f0444d24	match rp_id to fido2luks	2020-01-10 17:13:56 +01:00
Marek Mahut	a307d87d88	use password helper in modified environments	2020-01-10 16:52:22 +01:00
shimun	721dded6d2	WIP: 0.2.2 All checks were successful continuous-integration/drone/push Build is passing Details Warning: This release cointains changes to way credentials are generated, which may cause your authenticator to reject the old credential.	2020-01-09 22:22:54 +01:00
Shimun	e7049a281a	Use fido2luks as rp_id instead if default hmac, consider making All checks were successful continuous-integration/drone/push Build is passing Details credenials device specific	2020-01-02 15:35:32 +01:00
shimun	5d1c7beb4d	added flag to retry open command All checks were successful continuous-integration/drone/push Build is passing Details	2019-10-12 22:46:54 +02:00
shimun	2bac911b32	assigned exit codes to error cases	2019-10-12 22:46:20 +02:00
shimun	9a8ea993b5	fmt All checks were successful continuous-integration/drone/push Build is passing Details	2019-10-12 13:40:24 +02:00
shimunn	7eb9dcc928	Merge pull request #2 from jannic/add-test-cases Some checks failed continuous-integration/drone/push Build is failing Details Add test case for hash calculations	2019-10-12 13:24:33 +02:00
shimunn	509e300a8f	Merge pull request #1 from jannic/port-to-ring Use ring for sha256 calculation	2019-10-12 13:24:18 +02:00
Jan Niehusmann	42945956a6	Add test case for hash calculations While replacing the implementation of sha256, I noticed that there is no test case actually calling the hash calculations. Added two such test cases. Please note that I didn't verify that the result is correct, but just took the value the existing implementation returned. So those tests will only catch future regressions.	2019-10-11 22:15:21 +00:00
Jan Niehusmann	3cf5ccf2a0	Use ring for sha256 calculation According to https://rustsec.org/advisories/RUSTSEC-2016-0005.html, rust-crypto is unmaintained. Crates depending on rust-crypto should be ported to other crates. This port replaces rust-crypto with the sha2 implementation of ring, as fido2luks already depends on it via ctap_hmac. Note that it uses an old version of ring, so I used the same version, here.	2019-10-11 22:06:00 +00:00
shimun	79e9a37806	use cratesio deps only All checks were successful continuous-integration/drone/push Build is passing Details	2019-10-10 13:41:02 +02:00
shimun	d16118e695	Readme All checks were successful continuous-integration/drone/push Build is passing Details	2019-10-08 15:13:15 +02:00
shimunn	6e53449ff6	move config into etc All checks were successful continuous-integration/drone/push Build is passing Details	2019-10-08 14:50:31 +02:00
shimunn	fbcfdea96b	make salt cli option	2019-10-06 22:16:12 +02:00
shimunn	99e408cc8d	replaced InputSalt::Both with String option All checks were successful continuous-integration/drone/push Build is passing Details	2019-10-06 22:15:29 +02:00
Shimun	8fc9e0dcce	extended readme All checks were successful continuous-integration/drone/push Build is passing Details	2019-09-27 01:03:33 +02:00
shimunn	95a4f97f58	0.2.0 Some checks failed continuous-integration/drone/tag Build is failing Details continuous-integration/drone/push Build is passing Details	2019-09-22 21:19:33 +02:00
shimunn	5290ef5e42	fmt All checks were successful continuous-integration/drone/push Build is passing Details	2019-09-22 21:00:37 +02:00
shimunn	94fa5555e0	typos Some checks failed continuous-integration/drone/push Build is failing Details	2019-09-22 20:59:16 +02:00
shimunn	bd97e25dd8	cleanup Some checks failed continuous-integration/drone/push Build is failing Details	2019-09-22 20:55:36 +02:00
shimunn	a1ed3f7f8e	accept keyfiles for both add and replace key	2019-09-22 20:47:04 +02:00
shimunn	50fad9ce92	add subcommand to remove key from device Some checks failed continuous-integration/drone/push Build is failing Details	2019-09-22 20:39:21 +02:00
shimunn	de76f3f480	ensure stdout stays open All checks were successful continuous-integration/drone/push Build is passing Details	2019-09-22 17:57:25 +02:00
shimunn	4a3b6f8e23	integrate connected func All checks were successful continuous-integration/drone/push Build is passing Details	2019-09-21 01:10:09 +02:00
shimunn	afcb48110b	-> WIP	2019-09-21 01:01:29 +02:00
shimunn	78d5eafc9a	structopt	2019-09-20 17:03:32 +02:00
shimunn	84ffd1fb94	addkey exclusive	2019-09-20 14:49:15 +02:00
shimunn	8a9cf9019d	ask password twice	2019-09-20 00:52:04 +02:00
shimunn	46bcc2f52a	wait for device to be connected	2019-09-19 22:53:17 +02:00
shimunn	2235fddb9a	reduce iteration time to 50ms Some checks failed continuous-integration/drone/push Build is failing Details authenicator already prevents bruteforce, no need to slow down the unlock process any further	2019-09-19 20:07:57 +02:00
shimunn	6cde9206de	kill slot requires current password All checks were successful continuous-integration/drone/push Build is passing Details	2019-09-19 19:35:54 +02:00
shimunn	6128d1e30d	removed keyctl dependency All checks were successful continuous-integration/drone/push Build is passing Details	2019-09-19 19:02:52 +02:00