Key Escrow Service

Linux Restore Client

The TrueCrypt restore client install involves the TrueCrypt source code file and the wfu.tar.gz file. The first step is to download these two files.

These instructions assume you will begin with these two files in the same directory. We will assign a variable to this directory. Download and unzip the file.

  export BUILD=`pwd`
  tar xvzf wfu.tar.gz
  tar xvzf truecrypt-4.3a-source-code.tar.gz

This will create the directory wfu containing the libwfu files, and the directory truecrypt-4.3a-source-code containing the TrueCrypt source code.

Parameters to the configure command will enable the restore client components. This will actually add a few more functions to the escrow client library.

The following commands will configure, build, and install the restore client libwfu API in /usr/local/wfu/.

 cd $BUILD
 tar xvzf wfu.tar.gz

 cd $BUILD/wfu

 ./configure --prefix=/usr/local/wfu \
             --enable-restore        \
             --enable-log=none     

 make 
 make install

Next, we will build the TrueCrypt client and link in the libwfu.a library. This is the same as the escrow client, but one additional patch is added to Cli.c

 cd $BUILD
 tar xvzf truecrypt-4.3a-source-code.tar.gz

 cd $BUILD/truecrypt-4.3a-source-code

 patch Common/Volumes.c    < $BUILD/wfu/linux/Volumes.patch
 patch Linux/Cli/Cli.c     < $BUILD/wfu/linux/Cli_restore.patch
 patch Linux/Cli/Cli.c     < $BUILD/wfu/linux/Cli_escrow.patch
 patch Linux/Cli/Makefile  < $BUILD/wfu/linux/Makefile.patch
 patch Linux/build.sh      < $BUILD/wfu/linux/build.patch

 cd Linux
 ./build.sh
 ./install.sh

NOTE: We configured the libwfu with --prefix=/usr/local/wfu. The build.sh will look for the files in /usr/local/wfu. If you chose to install the libwfu in another directory, you will need to modify the build command. Let's say you chose --prefix="/opt/wfu", then you can issue the following build command:

 ./configure --prefix=/opt/wfu \
 ...
 cd Linux
 LIBWFU="/opt/wfu"  ./build.sh
 ./install.sh

Configuration

The restore client configuration file will include the DNS name of the server, the TCP port number of the service and the Certificate Authority's public key.

In addition, the restore client will need all three RSA tags.

The TrueCrypt restore client will look in the user's home directory for the configuration file. The file should be stored in ~/wfu_escrow/config.xml.

The following is an example of a restore client configuration file.

# cat ~/wfu_escrow/config.xml 

  <ESCROW>

    <SERVER_NAME> scrow.wfu.edu </SERVER_NAME>
    <TCP_PORT> 1111 </TCP_PORT>

    <SSL_CLIENT_CERT>
        /usr/local/wfu/CA/cacert.pem
    </SSL_CLIENT_CERT>


    <RSA_MODULUS>
    00:ad:49:5a:7e:c8:6f:bc:6b:1d:61:c7:45:fa:3c:
    d9:ff:bf:8c:e0:6c:0e:16:c8:d4:7f:d3:e2:3e:05:
    13:ca:f0:39:46:f3:50:9d:6e:ca:d3:49:08:a8:c5:
    e6:e0:07:76:36:63:e0:ba:2f:70:90:ec:bf:8c:0a:
    ed:5c:22:9a:8b
    </RSA_MODULUS>

    <RSA_PUBLIC>
        10001
    </RSA_PUBLIC>

    <RSA_PRIVATE>
        00:82:93:8b:c5:8d:73:e5:1f:31:fc:c4:14:4f:04:
        1b:a1:43:cd:fc:2e:70:4f:6a:f5:f5:7c:cc:36:bf:
        cc:b2:56:24:dc:e0:67:5d:c9:b4:d7:3c:c6:da:bd:
        77:e2:c5:3c:87:09:c9:0a:98:05:4f:9f:2a:01:4e:
        05:87:2a:31:01
    </RSA_PRIVATE>

  </ESCROW>