Encrypted Volume and File System v2.2 Administrator Guide (777846-001, April 2014)

passphrase from other users, the passphrase will be automatically read from the file (see “Using
the evfsrun command” (page 127)). However, when entering a secure session (see “Using a secure
session” (page 108)), a user will be always prompted for the passphrase regardless if it has been
stored in a file (in other words, the stored passphrase will be ignored).
CAUTION: A stored passphrase enables you to use the EVFS autostart feature, but it is a security
risk. In EFS mode, it is possible for root to access the encrypted files of users that have a stored
passphrase.
Using HP-UX Trusted Computing Services with EVFS
On systems with HP-UX Trusted Computing Services (TCS), you can use TCS to secure EVFS private
keys. For more information, see the HP-UX TCS product documentation.
How EVFS uses keys
EVFS uses symmetric volume or file encryption keys to encrypt the volume or file data. EVFS also
uses public/private keys to encrypt the symmetric encryption keys, and it uses passphrases to
encrypt private keys, as follows:
• The symmetric encryption key is stored in key records, or digital envelopes, in the EMD area
of the EVFS volume or file. Each key record contains the volume or file encryption key, encrypted
by a user's public key.
• User's public keys are stored in a local database, unencrypted.
• User's private keys are stored in a local database. Each private key is encrypted with a
passphrase.
• As an option, a passphrase can be stored in a file, encrypted with system-specific data. A
stored passphrase is a security risk. However, it enables you to execute some EVFS commands
without entering a passphrase and to use the EVFS autostart feature.
When accessing encrypted data stored on an EVS or EFS volume, the following steps are performed:
1. The passphrase is used to decrypt the user's private keys.
2. The decrypted private key is used to decrypt the file or volume symmetric encryption key stored
in the EMD area.
3. The data stored on the volume or file is encrypted/decrypted using this unwrapped symmetric
key.
Key names and key IDs
Each public/private key pair has an owner and a key name. A user can have multiple public/private
key pairs. The default key name (the name EVFS uses if you do not specify a key name) is the
owner's user account name. For EFS mode, a user must have a key pair with the default key name.
Public/private key pairs are also identified by a key ID formed by concatenating the owner's user
account name and the key name, separated by a period (.). For example, the user bob owns the
key pair named bobkey1. The key ID for this key pair is bob.bobkey1. For EFS mode, bob must
have a key pair with a key ID bob.bob.
For EVFS, the user login name and key name are limited to 100 characters.
User key and passphrase storage
By default, EVFS stores keys in a local database under the directory /etc/evfs/pkey. EVFS
creates a users subdirectory for all the users keys, then it creates a subdirectory under users
for each user who owns EVFS user keys. The subdirectory name is the user account name.
Key names and key IDs 23