Remote LUKS disk decryption over mTLS

Hacker News

I have two VPSs with full disk encryption. Sadly, neither provides a TPM so I've always had to connect by SSH to type my password. I've spent the last weekend thinking of a way to automate the process without weakening the threat model and came up with this protocol. You can find the sequence diagram in the README, consider that the spec. This is the threat model: - Internal network is trusted, nodes are not. However, a compromised network unlock server won't collude with a network attacker. - Attacker has full access to the public network. - Attacker has eventual access to the disk and can recover any deleted file. Any full disk encryption unlocking scheme of a remote machine without a TPM, e.g. SSH-ing into a dropbear initramfs, is vulnerable to the same attacker: someone who can read your unencrypted /boot partition and sit on your network. Against dropbear, they extract the SSH host key from the initramfs, impersonate your server, and capture the passphrase you type. This protocol doesn't strive to be stronger than that, it accepts the same threat model. An attacker with disk access + network access within the TTL window can steal the ephemeral TLS cert + key from /boot, connect to the server, and retrieve Na. The protocol just removes the human from the loop while being no worse than typing a password over SSH. I'm running this on my pair of VPSs, so if anyone finds a hole inside the threat model please let me know! I don't run anything critical but would rather not get hacked by playing with homebrew protocols. This wasn't vibe coded, so you'd be arguing with my ideas and not an LLM.

Visit product View on Hacker NewsMar 24, 2026

Share card

Actual performance

3points

Did not reach leaderboard

Launch Intel predictions

Analyze your own launch →

Product HuntOn track for Day 1 leaderboard · Strong signals: mac, model, code · Missing: agents, macos, agent

74%74% predicted probability of success on Product Hunt, based on ML models trained on real launch data.

Hacker NewsStrong engagement from HN community · Strong signals: ide, io · Missing: https docs, excited, just released

74%74% predicted probability of success on Hacker News, based on ML models trained on real launch data.

nativeThis product was originally launched on this platform.

Indie HackersFits the IH revenue-focused audience · Missing: supports, reddit linkedin, podcasting

65%65% predicted probability of success on Indie Hackers, based on ML models trained on real launch data.

TrustMRRLess likely to generate early MRR · Strong signals: way · Missing: mobile apps, ios, personal

47%47% predicted probability of success on TrustMRR, based on ML models trained on real launch data.

AppSumoMay struggle as an AppSumo deal · Strong signals: host · Missing: plus, platform, intuitive

34%34% predicted probability of success on AppSumo, based on ML models trained on real launch data.

Acquire.comPre-revenue stage for this audience · Missing: arr, mrr, revenue

17%17% predicted probability of success on Acquire.com, based on ML models trained on real launch data.

BetaListMay not resonate with beta-testers · Missing: web3, chat, crypto

4%4% predicted probability of success on BetaList, based on ML models trained on real launch data.

Incorrect prediction on native model

Similar products

Hessellate – Hyperbolic Tessellations on the Poincaré Disk60%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Hessellate – Hyperbolic Tessellations on the Poincaré Disk

Hacker News2

DiskBOX48%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

See what’s filling your disk — and take control

Indie Hackerscommitment-side-project

Check what is hogging your disk zpace67%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Check what is hogging your disk zpace

Hacker News5

FindDiskKiller91%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

See which apps are hammering your Mac's disk

Product Hunt+106Mac

btdu, a sampling disk usage profiler for btrfs63%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

btdu, a sampling disk usage profiler for btrfs

Hacker News12

FolderStatsApp – analyse your disk usage with treemap visualisation49%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

FolderStatsApp – analyse your disk usage with treemap visualisation

Hacker News1

SpaceStatter – The enlightening disk analyzer56%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

SpaceStatter – The enlightening disk analyzer

Hacker News1

Lavastone – C++ Containers Transparently Backed by Disk59%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Lavastone – C++ Containers Transparently Backed by Disk

Hacker News7

IndieWorkspace – A sneak peak at remote workspaces51%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

IndieWorkspace – A sneak peak at remote workspaces

Hacker News9

USPS Remote Encoding Facility37%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

USPS Remote Encoding Facility

Hacker News1

Browse all products Analyze your launch