The Librem Key comes preloaded with the PureBoot bundle to protect your firmware. While it’s good at protecting your boot firmware, that’s only some of what it can do.
You can also encrypt your computer’s file system, auto lock on removal, and encrypt local documents just to get started.
By default, PureOS has an encrypted filesystem protected with a passphrase. But you can also use your Librem Key and your pin to unlock the files. To do so, You’ll need your Public key your Librem key uses. When you receive your Librem key, the Public key is shipped along with the Librem Key on a Thumb drive we call the Librem Vault.
You can also reset your Librem Key and store the public keys on a thumb drive from within Pureboot.
OEM Factory Reset
To get access to both the public and private keys, you’ll need to generate your own keys manually and copy them onto the Librem key. See our docs for full steps. Once you know where your Public key is. Run these commands:
sudo apt install git scdaemon
git clone https://source.puri.sm/pureos/packages/smartcard-key-luks
sudo ./smartcard-key-luks /path/to/your/key.asc
You’ll be asked for your PIN on your Librem Key, and the unlock password on the drive. Once this is set up, you’ll need to reboot and re-sign your boot files. After that, you’ll be greeted with this menu on every reboot. With your Librem Key attached, enter your pin to unlock your computer.
You can still use your original passphrase without your Librem Key, by selecting:
Boot Options ->
Ignore tampering ->
recovery mode Note, If you end up in the ram disk, press
ctrl + D to continue to boot. Since you normally would use the Librem Key and its PIN to unlock your disk, you can consider using a much stronger passphrase for your backup option here.
Your public key can also be used to secure local files that require the use of your Librem key to decrypt.
To use it, import your key with gpg
gpg --import /path/to/your/key.asc
With the public key imported, you can encrypt files by specifying the recipient.
gpg -r <email> -e /path/to/file/to/encrypt
Then, with your Liberm key attached, run this command on the resulting gpg encrypted file to regain access.
gpg --decrypt example.txt.gpg
You can also configure your Librem device to lock when you remove the Librem Key.
This can be really handy to protect your computer when you walk away.
To enable auto-locking, Download and run this script as root:
git clone https://source.puri.sm/david.hamner/auto-lock-setup
You can also manually copy these files into place.
From individual documents, to low-level file systems, all the way to your boot firmware, the Librem key can protect you on many levels. While not covered in this video, you can also sign email, post your public key to a key server, and create multiple Liberm Keys with duplicate keys. Take control of your data with the Librem key.
You can find the full documentation about the Librem Key.
|Librem Mini||In Stock||10 days|
|Librem Servers||Out of Stock||--|
|Librem Key||In Stock||10 days|
|Librem 14||In Stock||10 days|
|Librem 5 USA||In Stock||10 days|
|Librem 5||Currently shipping backlogs||52 weeks|