Latest posts by David Hamner (see all)

The Librem Key comes preloaded with the PureBoot bundle to protect your firmware. While it’s good at protecting your boot firmware, that’s only some of what it can do.

You can also encrypt your computer’s file system, auto lock on removal, and encrypt local documents just to get started.

Encrypted Filesystem

By default, PureOS has an encrypted filesystem protected with a passphrase. But you can also use your Librem Key and your pin to unlock the files. To do so, You’ll need your Public key your Librem key uses. When you receive your Librem key, the Public key is shipped along with the Librem Key on a Thumb drive we call the Librem Vault.

You can also reset your Librem Key and store the public keys on a thumb drive from within Pureboot. Options -> OEM Factory Reset

To get access to both the public and private keys, you’ll need to generate your own keys manually and copy them onto the Librem key. See our docs for full steps. Once you know where your Public key is. Run these commands:

sudo apt install git scdaemon
git clone https://source.puri.sm/pureos/packages/smartcard-key-luks
cd smartcard-key-luks
sudo ./smartcard-key-luks /path/to/your/key.asc

You’ll be asked for your PIN on your Librem Key, and the unlock password on the drive. Once this is set up, you’ll need to reboot and re-sign your boot files. After that, you’ll be greeted with this menu on every reboot. With your Librem Key attached, enter your pin to unlock your computer.

You can still use your original passphrase without your Librem Key, by selecting: Options -> Boot Options -> Ignore tampering -> recovery mode Note, If you end up in the ram disk, press ctrl + D to continue to boot. Since you normally would use the Librem Key and its PIN to unlock your disk, you can consider using a much stronger passphrase for your backup option here.

File encryption

Your public key can also be used to secure local files that require the use of your Librem key to decrypt.

To use it, import your key with gpg

gpg --import /path/to/your/key.asc

With the public key imported, you can encrypt files by specifying the recipient.

gpg -r <email> -e /path/to/file/to/encrypt

Then, with your Liberm key attached, run this command on the resulting gpg encrypted file to regain access.

gpg --decrypt example.txt.gpg

Auto-locking

You can also configure your Librem device to lock when you remove the Librem Key.

This can be really handy to protect your computer when you walk away.

To enable auto-locking, Download and run this script as root:

git clone https://source.puri.sm/david.hamner/auto-lock-setup
cd auto-lock-setup
sudo ./auto_lock_setup

You can also manually copy these files into place.

Wrap up

From individual documents, to low-level file systems, all the way to your boot firmware, the Librem key can protect you on many levels. While not covered in this video, you can also sign email, post your public key to a key server, and create multiple Liberm Keys with duplicate keys. Take control of your data with the Librem key.

You can find the full documentation about the Librem Key.

Purism Products and Availability Chart

 ModelStatusLead Time 
Most Secure PC Purism Librem Mini
Librem MiniIn Stock10 days
Most Secure Server Purism Librem ServersLibrem ServersOut of Stock--
USB Security Token Purism Librem KeyLibrem KeyIn Stock10 days
Most Secure Laptop Purism Librem 14Librem 14In Stock10 days
Made in USA Phone Purism Librem 5 USALibrem 5 USAIn Stock10 days
Librem 5Currently shipping backlogs52 weeks
The current product and shipping chart of Purism Librem products, updated on September 2, 2022

Recent Posts

Related Content

Tags