Booting encrypted

[Bruce M Simpson]

Hello,

It really depends on how far you want to go to protect the product, and
what your threat model looks like.

On Wed, Sep 15, 2004 at 07:17:33PM -0700, ctodd at chrismiller.com wrote:
> My main objective is to prevent someone from removing the drive and
> mounting it from another *nix system and turning it into a unix toy
> (turning on shell access, etc) which it's not designed to be, as well as
> getting at the application and configuration. By having encryption done by
> the loader in such a way that the key can not be derived, protects the
> entire filesystem from tampering. Nothing this appliance is going to be
> doing requires super fast disk i/o so encryption is not an issue. In fact
> I've even considered using flash instead of a drive, but the same issue is
> there.

This is more or less what I'd proposed. The key element here is that if your
key for the hard drive is stored IN ANY WAY on the hard drive, particularly
in or near the loader, your appliance would be cracked fairly easily.

Using TCPA, you could lock down your device in this way, and extract the
symmetric key for the media from nonvolatile secure storage on the chip
once the OS has logged into it. Of course you'd have to sign the OS image
in such a way that booting it unlocked the secure storage. I haven't
researched this point in depth but I think it may be possible.

The TCPA chip generally hangs off the ICH chip in Intel chipset based
systems, on the LPC bus PCI function; it's possible that you could retrofit
this to a board if the existing board design does not have TCPA pinned out,
by pinning out LPC, or by pinning out ISA and slotting it in on a board.

Regards,
BMS