Booting encrypted

[Frank Knobbe]

On Wed, 2004-09-15 at 22:24, Bruce M Simpson wrote:
> Using TCPA, you could lock down your device in this way, and extract the
> symmetric key for the media from nonvolatile secure storage on the chip
> once the OS has logged into it. Of course you'd have to sign the OS image
> in such a way that booting it unlocked the secure storage. 


Yes, TCPA offers solutions for that. But they might be overkill for what
he wants to accomplish. Having the key in the boot loader will do what
he wants -- prevent someone booting from a CD and mounting the drive.
But the key on the encrypted media itself (in the boot loader) is bad
practice. Hence the idea of fetching it from hardware.

Sure, it is still possible to break the systems (by booting a CD,
reading the CPU ID, or VGA S/N, or whatever is used, and manually
decrypting the drive). But it presents a significantly higher effort,
while still not dependent on TCPA ready hardware and all the (key)
management stuff that comes with it. Call it a poor-mans TCPA :)

It's a balance, an in-between. For real security, choose TCPA. For
good-enough security, this solution may work better.

All depends on the level of paranoia present :)

Cheers,
Frank

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: This is a digitally signed message part
Url : http://lists.freebsd.org/pipermail/freebsd-hackers/attachments/20040916/f57b0bd9/attachment.bin