# Encrypting without NTP **URL:** \ **Category:** Encrypting File System\ **Created:** [November 4, 2024, 12:06pm UTC](https://community.zymbit.com/t/encrypting-without-ntp/1713 "2024-11-04T12:06:19Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![aneum](https://avatars.discourse-cdn.com/v4/letter/a/cab0a1/32.png) [@aneum](https://community.zymbit.com/u/aneum)\ **Post date:** [November 4, 2024, 12:06pm UTC](https://community.zymbit.com/t/encrypting-without-ntp/1713/1 "2024-11-04T12:06:19Z")
Hello! We’re currently investigating the use of the Zymkey 4i for encrypting our Linux rootfs on an RPi CM3+. Previous investigations during Ubuntu 20.04 times showed it would be possible to just generate a locked key from within a special initramfs for easy first-bootup setup in a factory, resulting in an encrypted rootfs and bootup via the Zymkey. With Ubuntu 22.04 though it shows that temporarily running zkifc for setting up `/var/lib/zymbit` doesn’t result in creation of the required salt file anymore, resulting in an incomplete state during key creation for LUKS to be prepared with a new key. This is with a custom initramfs which just sets up the device after factory flash and deletes itself from storage after completion. Have there been changes to the zk utilities that disallow setup without NTP? During factory setup the device wouldn’t have networking abilities, hence it would require a different way of setting up the environment. Thanks. ---
**Author:** ![Bob\_of\_Zymbit](https://avatars.discourse-cdn.com/v4/letter/b/82dd89/32.png) [@Bob\_of\_Zymbit](https://community.zymbit.com/u/Bob_of_Zymbit)\ **Post date:** [November 6, 2024, 11:09pm UTC](https://community.zymbit.com/t/encrypting-without-ntp/1713/2 "2024-11-06T23:09:04Z")
@aneum - The short answer is no, nothing changed specifically. I’m not sure if something changed from 20.04 to 22.04. Can you outline the steps that left you without a salt file? ---
**Author:** ![aneum](https://avatars.discourse-cdn.com/v4/letter/a/cab0a1/32.png) [@aneum](https://community.zymbit.com/u/aneum)\ **Post date:** [November 11, 2024, 8:34am UTC](https://community.zymbit.com/t/encrypting-without-ntp/1713/3 "2024-11-11T08:34:48Z")
@Bob_of_Zymbit I would prefer not sharing the script publicly, but in a gist what happens is: - Create `/run/zkstatus` - Run `/bin/zkifc -s /var/lib/zymbit &` - sleep for 15 seconds until killing the zkifc process - `zkgrifs 512 > /run/key.bin` - `zklockifs /run/key.bin > /run/key.bin.lock` - `cryptsetup luksAddKey /dev/mmcblk0p2 /run/key.bin` - Put the `/run/key.bin.lock` in the rootfs This is all in the first-boot initramfs without networking. ---
**Author:** ![aneum](https://avatars.discourse-cdn.com/v4/letter/a/cab0a1/32.png) [@aneum](https://community.zymbit.com/u/aneum)\ **Post date:** [November 13, 2024, 10:52am UTC](https://community.zymbit.com/t/encrypting-without-ntp/1713/4 "2024-11-13T10:52:24Z")
@Bob_of_Zymbit ping. We’re not going to be able to evaluate use of the Zymkey without help. ---
**Author:** ![davidgs](https://yyz1.discourse-cdn.com/flex027/user_avatar/community.zymbit.com/davidgs/32/1192_2.png) [@davidgs](https://community.zymbit.com/u/davidgs)\ **Post date:** [November 13, 2024, 12:38pm UTC](https://community.zymbit.com/t/encrypting-without-ntp/1713/5 "2024-11-13T12:38:03Z")
I know that @Bob_of_Zymbit is working on diagnosing this, but I wonder if you could further explain this part. > [@aneum](#): > > - sleep for 15 seconds until killing the zkifc process Are you saying that after 15 seconds your script kills the `zkifc` process? dg ---
**Author:** ![aneum](https://avatars.discourse-cdn.com/v4/letter/a/cab0a1/32.png) [@aneum](https://community.zymbit.com/u/aneum)\ **Post date:** [November 13, 2024, 12:50pm UTC](https://community.zymbit.com/t/encrypting-without-ntp/1713/6 "2024-11-13T12:50:45Z")
Yes. Previously it was 10 seconds as that was enough for `zkifc` to create the necessary salt file. ---
**Author:** ![Bob\_of\_Zymbit](https://avatars.discourse-cdn.com/v4/letter/b/82dd89/32.png) [@Bob\_of\_Zymbit](https://community.zymbit.com/u/Bob_of_Zymbit)\ **Post date:** [November 13, 2024, 10:10pm UTC](https://community.zymbit.com/t/encrypting-without-ntp/1713/7 "2024-11-13T22:10:37Z")
@aneum what are the permissions on your /var/lib/zymbit? Do you have a zymbit user? Can you show me `ls -lR /var/lib/zymbit` ? ```sh zymbit@pi4:~$ ls -lR /var/lib/zymbit/ /var/lib/zymbit/: total 12 drwx------ 2 zymbit zymbit 4096 Nov 13 14:07 254FFD9C0E50A13A02038D23A81BF747CA19F9F80FAA985288DEF700FE23DE44 -rw-r--r-- 1 root root 251 Jan 9 2022 ntp_str.json drwxrwxr-x 3 root zk_pkcs11 4096 Nov 13 14:03 zk_pkcs11 /var/lib/zymbit/254FFD9C0E50A13A02038D23A81BF747CA19F9F80FAA985288DEF700FE23DE44: total 8 -rw------- 1 zymbit zymbit 32 Nov 13 14:07 s1_fp_salt.bin -rw------- 1 zymbit zymbit 600 Nov 13 14:07 state /var/lib/zymbit/zk_pkcs11: total 4 drwxrwxr-x 2 root zk_pkcs11 4096 Nov 13 14:03 tokens /var/lib/zymbit/zk_pkcs11/tokens: total 0 ``` If the permissions are not an issue, can you try waiting after you kill zkifc? I tried something like this: ```bash #!/bin/bash set -x rm -rf /var/lib/zymbit/* rm /tmp/y ls -lR /var/lib/zymbit mkdir -p /run/zkstatus /bin/zkifc -s /var/lib/zymbit & sleep 5 ls -lR /var/lib/zymbit killall zkifc sleep 5 echo "Running standalone zkgrifs..." zkgrifs 64 > /tmp/y ls -l /tmp/y echo "Done" ``` ---
**Author:** ![aneum](https://avatars.discourse-cdn.com/v4/letter/a/cab0a1/32.png) [@aneum](https://community.zymbit.com/u/aneum)\ **Post date:** [November 14, 2024, 9:06am UTC](https://community.zymbit.com/t/encrypting-without-ntp/1713/8 "2024-11-14T09:06:13Z")
@Bob_of_Zymbit I won’t be able to copy-paste much of the contents from here, again the ZK utilities and key generation scripts are run inside of a custom initramfs which we boot into and remove/shred prior to shipping the device. Additionally, it required a stub `timedatectl` script which returns a status output similar to regular `timedatectl` from systemd when invoked. I could give adding a bit of sleep after killing `zkifc` a shot though, but all the hurdles in the way lead me to believe you are not very interested in running this without some NTP time synchronization guarantee. ---
**Author:** ![Bob\_of\_Zymbit](https://avatars.discourse-cdn.com/v4/letter/b/82dd89/32.png) [@Bob\_of\_Zymbit](https://community.zymbit.com/u/Bob_of_Zymbit)\ **Post date:** [November 14, 2024, 6:59pm UTC](https://community.zymbit.com/t/encrypting-without-ntp/1713/9 "2024-11-14T18:59:00Z")
Yes, zkifc wants an NTP sync, but your binding will take place without it. And your use case sounds like you don’t need zkifc once you get through your initial setup. ---
**Author:** ![aneum](https://avatars.discourse-cdn.com/v4/letter/a/cab0a1/32.png) [@aneum](https://community.zymbit.com/u/aneum)\ **Post date:** [November 25, 2024, 10:41am UTC](https://community.zymbit.com/t/encrypting-without-ntp/1713/10 "2024-11-25T10:41:08Z")
@Bob_of_Zymbit I’ve figured out a way to set up the Zymkey with our custom OS and factory process. We do the setup in the main rootfs via a systemd target and a well known “temporary” LUKS key. Boot into the systemd target with the known LUKS key, set it all up, and remove the well-known LUKS key afterwards. ---
**Author:** ![Bob\_of\_Zymbit](https://avatars.discourse-cdn.com/v4/letter/b/82dd89/32.png) [@Bob\_of\_Zymbit](https://community.zymbit.com/u/Bob_of_Zymbit)\ **Post date:** [November 25, 2024, 5:02pm UTC](https://community.zymbit.com/t/encrypting-without-ntp/1713/11 "2024-11-25T17:02:44Z")
We’ve had other people do similar things in their production stage. Glad you found a solution that works.