Librem Key Goodies (Part 1)

• About
• Latest Posts

David Hamner

Latest posts by David Hamner (see all)

• Easy App Development: Text Forwarding - January 22, 2024
• Retain Your Control and Customize Everything with Modular Software - January 22, 2024
• Nasty Software - December 18, 2023

The Librem Key comes preloaded with the PureBoot bundle to protect your firmware. While it’s good at protecting your boot firmware, that’s only some of what it can do.

You can also encrypt your computer’s file system, auto lock on removal, and encrypt local documents just to get started.

Encrypted Filesystem

By default, PureOS has an encrypted filesystem protected with a passphrase. But you can also use your Librem Key and your pin to unlock the files. To do so, You’ll need your Public key your Librem key uses. When you receive your Librem key, the Public key is shipped along with the Librem Key on a Thumb drive we call the Librem Vault.

You can also reset your Librem Key and store the public keys on a thumb drive from within Pureboot. Options -> OEM Factory Reset

To get access to both the public and private keys, you’ll need to generate your own keys manually and copy them onto the Librem key. See our docs for full steps. Once you know where your Public key is. Run these commands:

sudo apt install git scdaemon
git clone https://source.puri.sm/pureos/packages/smartcard-key-luks
cd smartcard-key-luks
sudo ./smartcard-key-luks /path/to/your/key.asc


You’ll be asked for your PIN on your Librem Key, and the unlock password on the drive. Once this is set up, you’ll need to reboot and re-sign your boot files. After that, you’ll be greeted with this menu on every reboot. With your Librem Key attached, enter your pin to unlock your computer.

You can still use your original passphrase without your Librem Key, by selecting: Options -> Boot Options -> Ignore tampering -> recovery mode Note, If you end up in the ram disk, press ctrl + D to continue to boot. Since you normally would use the Librem Key and its PIN to unlock your disk, you can consider using a much stronger passphrase for your backup option here.

File encryption

Your public key can also be used to secure local files that require the use of your Librem key to decrypt.

To use it, import your key with gpg

gpg --import /path/to/your/key.asc

With the public key imported, you can encrypt files by specifying the recipient.

gpg -r <email> -e /path/to/file/to/encrypt

Then, with your Liberm key attached, run this command on the resulting gpg encrypted file to regain access.

gpg --decrypt example.txt.gpg

Auto-locking

You can also configure your Librem device to lock when you remove the Librem Key.

This can be really handy to protect your computer when you walk away.

To enable auto-locking, Download and run this script as root:

git clone https://source.puri.sm/david.hamner/auto-lock-setup
cd auto-lock-setup
sudo ./auto_lock_setup

You can also manually copy these files into place.

Wrap up

From individual documents, to low-level file systems, all the way to your boot firmware, the Librem key can protect you on many levels. While not covered in this video, you can also sign email, post your public key to a key server, and create multiple Liberm Keys with duplicate keys. Take control of your data with the Librem key.

You can find the full documentation about the Librem Key.

Purism Products and Availability Chart

	Model	Status	Lead Time
	Librem Key (Made in USA)	In Stock ($59+)	10 business days	Learn More Buy Now
	Librem 5	In Stock ($699+) 3GB/32GB	10 business days	Learn More Buy Now
	Librem 5 COMSEC Bundle	In Stock ($1299+) Qty 2; 3GB/32GB	10 business days	Learn More Buy Now
	Liberty Phone (Made in USA Electronics)	Backorder ($1,999+) 4GB/128GB	Estimated fulfillment February	Learn More Buy Now
	Librem 5 + SIMple (3 GB Data)	In Stock ($99/mo)	10 business days	Learn More Buy Now
	Librem 5 + SIMple Plus (5 GB Data)	In Stock ($129/mo)	10 business days	Learn More Buy Now
	Librem 5 + AweSIM (Unlimited Data)	In Stock ($169/mo)	10 business days	Learn More Buy Now
	Librem 11	In Stock ($999+) 8GB/1TB	10 business days	Learn More Buy Now
	Librem 14	Backorder ($1,370+)	Estimated fulfillment December	Learn More Buy Now
	Librem Mini	Backorder ($799+)	10 business days	Learn More Buy Now
	Librem Server	In Stock ($2,999+)	45 business days	Learn More Buy Now