I co-authored a project that works on Debian that do unattended reboots of encrypted disk drives which allows for scenarios where Alice don't know any part of the key. Every time the machine boots up bob get a request on the network and he can chose to approve or deny. Bob in turn could be in a different country which would make coercion a bit hard.
I think I remember you giving a talk about this at SmashTheStack in Malmo, Sweden.
I believe I asked then about maybe having support for non-debian systems and eventually something like Windows in the distant future.. What kind of support would you need for it to be worthwhile investing in that?
(I’m not sure what support or investing would mean in this context.) A Windows programmer could probably port the server side program (which holds the passwords) relatively easily, since it is currently implemented as a normal daemon in Python, and could therefore conceivably be ported or re-written to suit any Internet-connected platform, and the network protocol is fully documented. The client program (which receives the password and uses it to de-crypt the disk), on the other hand, is not so simple to implement. But the problem is not the network protocol; that is relatively simple. The hard part is instead running in the limited environment which exists before the password is available. In Debian, this means writing a program to run in the initramfs system where a kernel is available, but no networking is configured, and no standard system services are available. I have no idea what this would mean in a Windows context. I have toyed with the idea that it might be technically possible to re-write the client to run in the EFI environment, but I have not looked into it – it may or may not be feasible; would one have to write one’s own ZeroConf library? How about a TLS library supporting OpenPGP keys (as per RFC 6091)? How would one even provide a password for unlocking the disk to, for instance, VeraCrypt? Would one have to write the whole thing as a kind of module in VeraCrypt, if such a thing is even supported? I haven’t the foggiest notion of any answers to these questions, and I’m not a Windows nor a macOS programmer, and we implemented it on Debian since that is what we used at the time (and still do). Also, I’m gainfully employed full-time, so I’m not really looking for more work. To sum up, I would not personally be very suited for this kind of work due to inexperience on other platforms, nor could I take it on even if I were, due to personal time constraints. However, I would gladly support (by being available on the Mandos development mailing list) anyone doing this kind of work.
I love the idea of Mandos, but I've had some trouble setting it up and getting it working in the past :( And there doesn't seem to be much help on the internet; most guides are flimsy with no real information in them
I’m both sorry and surprised about that, since I thought we had documented everything appropriately. The thing to do after installing the mandos-client package, for instance, is to read /usr/share/doc/mandos-client/README.Debian.gz. That file contains the instructions for setting it up, and also the command to verify that it works before rebooting.
(Project called Mandos)