Profiles

What a profile is

A profile is a Linux user with an encrypted /home, stored on a disk that RedderOS calls a vault. Unlike a normal system, RedderOS does not store:

• any list of users or profiles;
• any hash or verifier of the passphrase;
• any header saying that the disk is encrypted.

Without the right name and passphrase, the vault is indistinguishable from random data. Nobody can tell how many profiles it holds, or whether it holds any at all.

The vault

A vault is an entire disk or partition:

1. It is filled with random data (AES-256-CTR with a key that is discarded immediately).
2. The first MiB is a random area; its first 32 bytes act as the salt.
3. The rest is divided into 8 slots of equal size, each at least 32 MiB. That is why the vault needs at least 257 MB.

The number of slots is fixed and is not stored on the disk: storing it would give away that there is a vault there.

How it is encrypted

To open a profile, the system derives the key and tries every slot on every disk. A slot is yours if decrypting it reveals an ext4 file system with that label. All slots are always tried, even if yours is the first, so that the response time gives nothing away.

When it is opened, a user with that name is created in RAM (its UID is computed from the name, so that file permissions match on every boot). When it is closed, the user is deleted from the system.

From the login screen

This is the usual way: Create profile… prepares the vault if needed, creates the profile and logs you in to it. The steps are in Getting started.

From the terminal

redder-profile needs root. In the normal boot anon has no sudo, so you need to boot with the Temporary administrator entry (see Boot menu).

sudo redder-profile disks                    # disks that can hold a vault
sudo redder-profile init /dev/sdb            # prepares the vault (ERASES the disk)
sudo redder-profile create /dev/sdb ana 5    # creates the profile "ana" in slot 5
sudo redder-profile status                   # open profiles
sudo redder-profile close ana                # closes the profile
sudo redder-profile open ana                 # opens it again

• init asks you to type SÍ ("yes") to confirm the erase.
• create asks for the passphrase twice and for confirmation before overwriting the slot. If you do not give a slot, it picks one at random.
• open does not ask for a disk: it searches all of them.

The full reference is in Commands.

Which disks are offered

Candidates are writable disks and partitions of at least 64 MiB, except the USB stick RedderOS booted from and any ISO image. To be a vault, each of the 8 slots must also be at least 32 MiB.

Identical errors on purpose

If the name does not exist or the passphrase is wrong, the message is the same: "No se ha podido abrir el perfil." ("The profile could not be opened."). A different message would reveal whether a profile exists.

Choosing a name and passphrase

• Name: starts with a lowercase letter or _ and is up to 32 characters long (lowercase letters, digits, - and _). anon and root are reserved.
• Passphrase: at least 12 characters. Argon2id makes each attempt slow, but a short or predictable passphrase will eventually fall. Use several random words that you do not use anywhere else.

If you forget the passphrase, there is no recovery: nobody keeps a copy.

"Zero knowledge" in this context

Here it means that whoever has the disk learns nothing without the passphrase. It is not a cryptographic zero-knowledge proof: that only makes sense when authenticating against a server.