Security

Managing your keys

Your encrypted disk can be opened more than one way: the passphrase you set at install, the printed recovery key, and — if you add them — a TPM2 or a hardware security key. shedman key manages all of them. Every change applies to the whole disk at once: the encrypted root and encrypted swap together.

See what you have:

sudo shedman key --status

On a standard encrypted install it prints something like:

/dev/disk/by-uuid/4d033633-…:
  slot 0: passphrase
  slot 1: recovery
  slot 2: recovery
  slot 3: recovery
  slot 4: recovery
  slot 5: tpm2
/dev/disk/by-uuid/1b480829-…:
  slot 0: passphrase
  …

Each line is one keyslot: your passphrase, the recovery key, an added passphrase, TPM2, or FIDO2. The recovery key takes several slots because it opens the disk however you type it — with or without the dashes, in any case — so a small transcription slip still lets you in. The two devices are the encrypted root and encrypted swap; every shedman key change applies to both.

Changing the passphrase

sudo shedman key change-passphrase

It asks for your current passphrase, then the new one twice. Passwordless unlock keeps working afterwards — there is nothing to re-enroll.

Rotating the recovery key

The recovery key is the printed fallback from install. If the paper is lost, or you just want a fresh one:

sudo shedman key rotate-recovery

A new key is shown once. Write it down before you confirm — ShedOS keeps it nowhere, and there is no command to reprint it.

The old key works until the new one is proven

Rotation adds the new key and checks that it opens the disk before it removes the old one. If anything goes wrong partway, your old recovery key still works. The disk is never reachable only by a key you have not written down yet.

Adding another way in

Add a second passphrase — handy for a shared machine, or a backup you keep elsewhere:

sudo shedman key add-key

Or enroll a FIDO2 security key — a YubiKey or similar — that opens the disk with a touch at boot:

sudo shedman key add-key --fido2

Plug the key in, run the command, and touch it when it blinks. From then on the boot prompt takes a touch of the key instead of a typed passphrase. Your passphrase and recovery key stay enrolled.

Removing a keyslot

sudo shedman key remove-key <slot>

Use the slot number from shedman key --status. This is how you drop an old passphrase, a recovery key you have rotated past, or a hardware key you no longer carry.

It will not let you lock yourself out

remove-key refuses to remove your last keyslot, and refuses your last passphrase or recovery key if only a TPM2 or hardware key would be left — those can fail on a firmware update or a lost key, and you would have no way in. A TPM2 slot is dropped with shedman tpm2 remove.