Re: Whole Disk Encryption + SSD

From	David Christensen <dpchrist@holgerdanske.com>
Newsgroups	linux.debian.user
Subject	Re: Whole Disk Encryption + SSD
Date	2021-06-30 01:00 +0200
Message-ID	<CvuRX-2At-1@gated-at.bofh.it> (permalink)
References	<Cv0TT-1C0-3@gated-at.bofh.it> <Cv6cV-4QX-1@gated-at.bofh.it> <Cv9kt-6AU-1@gated-at.bofh.it> <CvgFj-2Ft-3@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On 6/29/21 12:47 AM, tomas@tuxteam.de wrote:
> On Mon, Jun 28, 2021 at 07:56:47PM -0400, Stefan Monnier wrote:
>>> Along with SED, I suggest that you also implement Secure Boot.
>>
>> Can someone give me pointers to actually known attacks (not
>> hypothetical ones, which I can invent myself without much difficulty)
>> that would have been prevented by Secure Boot?
> 
> Basically, subverting the unencrypted loader amounts to what is known
> as "evil maid attack" [1]: the most practical variant being that the
> subverted loader records your passphrase (or whatever auth thingie you
> provide) and either "phones home" or stashes it away in a place your
> opponent can retrieve it.
> 
> The second time they have control over your device, they can unlock
> the disk.
> 
> The whole thing is well described in Wikipedia [2], along with some
> accounts of actual cases.
> 
> So /if/ you leave your laptop unsupervised and have the hunch that
> someone might have a chance at it, make sure you reinstall :-)
> 
> There is another, low-tech alternative to the monstrous Secure
> Boot [3] thingies bandied around here: carry your real boot partition
> with you, either in an USB stick or (nicer form factor) an SD card.
> Bonus points: you can leave a fake boot partition in your hard disk
> which can be checked at each boot; if it changed, you can go "Hmmm...
> someone tried to fool me..." and perhaps send them some passphrase.
> The wrong one, of course.
> 
> Cheers
> 
> [1] Yes, a sexist term, but it stuck, unfortunately. OTOH, perhaps
>     it's realistic in that it acknowledges that underpaid jobs are
>     usually carried out by women. Sigh.
> 
> [2] https://en.wikipedia.org/wiki/Evil_maid_attack
> 
> [3] I always have the impression that, with Secure Boot, Microsoft
>     has more control of the hardware (I paid for dearly, dammit!)
>     than myself. Don't ask me why, but I thoroughly dislike that
>     impression. So far I try to steer clear of it.

Thank you for that information.  :-)

I am reminded of the strategy of Defense in Depth [4].

SED, dm-crypt, and LUKS are mostly orthogonal to Secure Boot.  The 
former protects all or part of the drive contents, but only when the 
computer is off.  The latter protects critical system files, both when 
the computer is off and when the computer is booting and/or running.

SED provides all of the defenses dm-crypt and LUKS provide when the 
dm-crypt and LUKS partitions are on the SED.  But if the dm-crypt and 
LUKS partitions are moved off the SED in raw encrypted form (e.g. image/ 
clone), dm-crypt and LUKS have the advantage that security is preserved. 
  (If the partitions are decrypted and then moved -- e.g. backup/ 
restore -- security is lost.)

The only way to get all of the defenses is to implement all of the 
technologies -- SED, dm-crypt, LUKS, and Secure Boot.

This should be possible with Debian and a ~5 year old laptop -- SED is a 
purchasing decision, the laptop should have UEFI firmware that supports 
SED and Secure Boot, and Debian 10 supports Secure Boot, dm-crypt and 
LUKS.  But, as always, the only way to find out for a specific 
combination of Debian installer and computer is to try it.

David

[4] https://en.wikipedia.org/wiki/Security-in-depth

Thread

Whole Disk Encryption + SSD piorunz <piorunz@gmx.com> - 2021-06-28 17:00 +0200
  Re: Whole Disk Encryption + SSD Jochen Spieker <ml@well-adjusted.de> - 2021-06-28 18:00 +0200
  Re: Whole Disk Encryption + SSD David Christensen <dpchrist@holgerdanske.com> - 2021-06-28 22:40 +0200
    Re: Whole Disk Encryption + SSD David Christensen <dpchrist@holgerdanske.com> - 2021-06-29 00:00 +0200
    Re: Whole Disk Encryption + SSD Stefan Monnier <monnier@iro.umontreal.ca> - 2021-06-29 02:00 +0200
      Re: Whole Disk Encryption + SSD <tomas@tuxteam.de> - 2021-06-29 09:50 +0200
        Re: Whole Disk Encryption + SSD Stefan Monnier <monnier@iro.umontreal.ca> - 2021-06-30 00:50 +0200
        Re: Whole Disk Encryption + SSD David Christensen <dpchrist@holgerdanske.com> - 2021-06-30 01:00 +0200
    Re: Whole Disk Encryption + SSD Jonathan Dowland <jon+debian-user@dow.land> - 2021-06-29 11:30 +0200
    Re: Whole Disk Encryption + SSD piorunz <piorunz@gmx.com> - 2021-06-29 14:10 +0200
      Re: Whole Disk Encryption + SSD David Christensen <dpchrist@holgerdanske.com> - 2021-06-30 02:20 +0200
    Re: Whole Disk Encryption + SSD David Wright <deblis@lionunicorn.co.uk> - 2021-07-02 05:00 +0200
      Re: Whole Disk Encryption + SSD David Christensen <dpchrist@holgerdanske.com> - 2021-07-02 05:50 +0200
        Useless use of "dd" Teemu Likonen <tlikonen@iki.fi> - 2021-07-02 07:50 +0200
          Useful use of dd [was: Useless use of "dd"] <tomas@tuxteam.de> - 2021-07-02 09:50 +0200
            Re: Useful use of dd [was: Useless use of "dd"] Teemu Likonen <tlikonen@iki.fi> - 2021-07-02 12:30 +0200
              Re: Useful use of dd "Thomas Schmitt" <scdbackup@gmx.net> - 2021-07-02 13:00 +0200
                Re: Useful use of dd <tomas@tuxteam.de> - 2021-07-02 13:20 +0200
                Re: Useful use of dd Teemu Likonen <tlikonen@iki.fi> - 2021-07-02 13:30 +0200
                Re: Useful use of dd David Christensen <dpchrist@holgerdanske.com> - 2021-07-02 23:50 +0200
              Re: Useful use of dd [was: Useless use of "dd"] <tomas@tuxteam.de> - 2021-07-02 13:20 +0200
              Re: Useful use of dd Michael Stone <mstone@debian.org> - 2021-07-02 14:50 +0200
              Re: Useful use of dd [was: Useless use of "dd"] Kushal Kumaran <kushal@locationd.net> - 2021-07-02 21:10 +0200
                Creation of empty files [was: Useful use of dd] David Christensen <dpchrist@holgerdanske.com> - 2021-07-02 23:40 +0200
                Re: Creation of empty files [was: Useful use of dd] David Christensen <dpchrist@holgerdanske.com> - 2021-07-03 00:00 +0200
                Re: Creation of empty files [was: Useful use of dd] Michael Stone <mstone@debian.org> - 2021-07-03 15:50 +0200
                Re: Creation of empty files [was: Useful use of dd] David Christensen <dpchrist@holgerdanske.com> - 2021-07-03 23:40 +0200
                Re: Creation of empty files [was: Useful use of dd] Michael Stone <mstone@debian.org> - 2021-07-04 06:00 +0200
            Re: Useful use of dd [was: Useless use of "dd"] Greg Wooledge <greg@wooledge.org> - 2021-07-02 13:40 +0200
              Re: Useful use of dd [was: Useless use of "dd"] <tomas@tuxteam.de> - 2021-07-02 13:40 +0200
                Re: Useful use of dd [was: Useless use of "dd"] David Wright <deblis@lionunicorn.co.uk> - 2021-07-02 17:10 +0200
                Re: Useful use of dd [was: Useless use of "dd"] <tomas@tuxteam.de> - 2021-07-02 17:40 +0200
                Re: Useful use of dd [was: Useless use of "dd"] Gunnar Gervin <dofeelok@gmail.com> - 2021-07-03 09:20 +0200
                Re: Useful use of dd [was: Useless use of "dd"] <tomas@tuxteam.de> - 2021-07-03 09:30 +0200
            Useless use of shell pipelines [was: Useful use of dd] David Christensen <dpchrist@holgerdanske.com> - 2021-07-02 23:40 +0200
              Re: Useless use of shell pipelines [was: Useful use of dd] l0f4r0@tuta.io - 2021-07-03 10:30 +0200
                Re: Useless use of shell pipelines [was: Useful use of dd] Greg Wooledge <greg@wooledge.org> - 2021-07-03 15:40 +0200
          Re: Useless use of "dd" David Christensen <dpchrist@holgerdanske.com> - 2021-07-02 21:40 +0200
        Re: Whole Disk Encryption + SSD David Wright <deblis@lionunicorn.co.uk> - 2021-07-02 17:10 +0200
          Re: Whole Disk Encryption + SSD Michael Stone <mstone@debian.org> - 2021-07-02 17:30 +0200
          Re: Whole Disk Encryption + SSD David Christensen <dpchrist@holgerdanske.com> - 2021-07-02 20:40 +0200

csiph-web