Split GPG and LUKS

[Nick]

I've been reading the documentation and mailing list to get a better understanding on using a second internal HDD with Qubes.

I envision encrypting the entire drive with LUKS, and then using LVM to partition the device for individual appVM access. I plan on automating the unlocking of the drive by using a vault VM to store its key.

The questions I cannot seem to find answers to are:
1) Is there a way to incorporate the Split GPG keyring functionality into LUKS for encrypting the device (use the keyring to unlock the drive)?

2) Should the drive be unlocked in it's own VM? Dom0?

[Andrew David Wong]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

I don't think so. IIUC, those are two completely separate things.
Moreover, it would be entirely unnecessary if the LUKS encryption is
handled in dom0, since dom0 is always maximally trusted.

> 2) Should the drive be unlocked in it's own VM? Dom0?
>

In this case, it sounds like dom0 would be more appropriate.
Personally, I just add secondary disks in dom0 and use them as
secondary storage like so:

https://www.qubes-os.org/doc/secondary-storage/

You can encrypt these disks with LUKS and add them to your crypttab.

- --
Andrew David Wong (Axon)
Community Manager, Qubes OS
https://www.qubes-os.org
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJXaCIvAAoJENtN07w5UDAw3NwP+wSDbcpOT0JovUrBUsbCeZDx
IFNpHQVoKw2Ifs9SWHORzta6v1zIB7FdmzvbGZRnUJHw5QhwQBwXgWAEY2eSuKnd
bYIZfW1lRvJbeS4NAjgJS4akKu4LKOyppDZM02DTVVgWxkOYWS/Mp6b5TfIHeT/3
ep1zvoXYHiMXDqGU44g7Lr/+i/RqdAzUAjgtOgUEv7heRlNwz0CTzQ+yxKQGnFaE
QLxD+8In2muqkjy0Zayr5tq/nDtreJ9sSi4ku13pTFr00NDSgqRTAuwShSt2oyOc
4QQFN5in5kZS9ufha+TQySCuyGHUJSEIzHYx45opQbnd8oOx0mg2BN4HlaCQdIGS
h7WFO6loVtzhrH68vh27KyMEMRvbna80EiMgwjnv2zJY1cstDsO3+YnIADWXkp8M
2MvEHF4MaZQGmTqP+ZjdDokxiaCa1qQqnYH7JV5p3W7dURtW2kNbT2LB5z4g+IZa
oHaNbM3FRhHjQdGLUApibqdvhXl5eW1Oreo3Vgsh6m1eypk6iT39rIZLeS2lVfd/
NStM8OKfxJpukXxWsSY9vImBm9LAVDtCRSz/O0CaAJuau/pJBiSoxBq/iFv31DTV
OshlBIjuevZQIWeK2hCyVDVcpk4ZdhLbSGzIOvSlbJCnA21t4+wqoTWFohL+35Ay
c6lgMJ46CV1Jpp0ab7th
=wK7C
-----END PGP SIGNATURE-----