[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Whole Disk Encryption + SSD

On 6/29/21 12:47 AM, tomas@tuxteam.de wrote:

On Mon, Jun 28, 2021 at 07:56:47PM -0400, Stefan Monnier wrote:

Along with SED, I suggest that you also implement Secure Boot.


Can someone give me pointers to actually known attacks (not
hypothetical ones, which I can invent myself without much difficulty)
that would have been prevented by Secure Boot?


Basically, subverting the unencrypted loader amounts to what is known
as "evil maid attack" [1]: the most practical variant being that the
subverted loader records your passphrase (or whatever auth thingie you
provide) and either "phones home" or stashes it away in a place your
opponent can retrieve it.

The second time they have control over your device, they can unlock
the disk.

The whole thing is well described in Wikipedia [2], along with some
accounts of actual cases.

So /if/ you leave your laptop unsupervised and have the hunch that
someone might have a chance at it, make sure you reinstall :-)

There is another, low-tech alternative to the monstrous Secure
Boot [3] thingies bandied around here: carry your real boot partition
with you, either in an USB stick or (nicer form factor) an SD card.
Bonus points: you can leave a fake boot partition in your hard disk
which can be checked at each boot; if it changed, you can go "Hmmm...
someone tried to fool me..." and perhaps send them some passphrase.
The wrong one, of course.

Cheers

[1] Yes, a sexist term, but it stuck, unfortunately. OTOH, perhaps
    it's realistic in that it acknowledges that underpaid jobs are
    usually carried out by women. Sigh.

[2] https://en.wikipedia.org/wiki/Evil_maid_attack

[3] I always have the impression that, with Secure Boot, Microsoft
    has more control of the hardware (I paid for dearly, dammit!)
    than myself. Don't ask me why, but I thoroughly dislike that
    impression. So far I try to steer clear of it.



Thank you for that information.  :-)


I am reminded of the strategy of Defense in Depth [4].
SED, dm-crypt, and LUKS are mostly orthogonal to Secure Boot. The former protects all or part of the drive contents, but only when the computer is off. The latter protects critical system files, both when the computer is off and when the computer is booting and/or running.
SED provides all of the defenses dm-crypt and LUKS provide when the dm-crypt and LUKS partitions are on the SED. But if the dm-crypt and LUKS partitions are moved off the SED in raw encrypted form (e.g. image/ clone), dm-crypt and LUKS have the advantage that security is preserved. (If the partitions are decrypted and then moved -- e.g. backup/ restore -- security is lost.)
The only way to get all of the defenses is to implement all of the technologies -- SED, dm-crypt, LUKS, and Secure Boot.
This should be possible with Debian and a ~5 year old laptop -- SED is a purchasing decision, the laptop should have UEFI firmware that supports SED and Secure Boot, and Debian 10 supports Secure Boot, dm-crypt and LUKS. But, as always, the only way to find out for a specific combination of Debian installer and computer is to try it. 


David


[4] https://en.wikipedia.org/wiki/Security-in-depth
Reply to: