Yes, in general that's how I expect (or at least want) things to work. And I'm a tech-savvy software developer.
Your average non-technical user will absolutely expect it to work this way, and if it doesn't, will be at best confused, and at worst incredibly angry that their photos are gone.
Yes, that's kind of what you need to be able to successfully back up and restore an encrypted file. Why are you making it sound like that's such a strange thing to want?
The sane way for encryption keys stored in hardware (secure enclave or tpm like) is to onboard user when the key is not derived from user password. Just like they do for FDE to export a recovery key and then you can adjust your expectations when you know (been told) whats going on.
No, I'm asking for what LUKS has done for two decades. Keyslots are alternatives, not requirements, so a TPM slot and a passphrase slot coexist and either one alone unwraps the master key.
BitLocker does the same with key protectors. Even on a local account with no internet, there's always a 48-digit recovery password that opens the volume on a completely different machine.
Two of the three major platforms ship a portable passphrase path alongside the hardware one, so this being unavailable here is a product decision, not a law of key derivation.
Comments
You're asking for the encryption key to be derivable by an unrelated system that only has the encrypted file and your password.
Yes, in general that's how I expect (or at least want) things to work. And I'm a tech-savvy software developer.
Your average non-technical user will absolutely expect it to work this way, and if it doesn't, will be at best confused, and at worst incredibly angry that their photos are gone.
Yes, that's kind of what you need to be able to successfully back up and restore an encrypted file. Why are you making it sound like that's such a strange thing to want?
The sane way for encryption keys stored in hardware (secure enclave or tpm like) is to onboard user when the key is not derived from user password. Just like they do for FDE to export a recovery key and then you can adjust your expectations when you know (been told) whats going on.
No, I'm asking for what LUKS has done for two decades. Keyslots are alternatives, not requirements, so a TPM slot and a passphrase slot coexist and either one alone unwraps the master key.
BitLocker does the same with key protectors. Even on a local account with no internet, there's always a 48-digit recovery password that opens the volume on a completely different machine.
Two of the three major platforms ship a portable passphrase path alongside the hardware one, so this being unavailable here is a product decision, not a law of key derivation.