1

Is it possible to tie an SD card to a Raspberry Pi? I want it this way if you try the SD card in another Raspberry Pi that Linux does not start or that the SD card formats itself.

Furthermore, it should not be possible to read the contents of the SD card via another PC, i.e. the data are encrypted and need a password.

Is it somehow possible that before Raspbian is started that the data on the SD card gets decrypted with the Mac address of the Pi and so a normal boot process is possible?

  • 1
    no - if anyone can access the SD Card they can do anything, – Milliways Jul 19 at 12:46
2

Without providing you a step-by-step walkthrough, I can answer pieces of your question:

Is it possible to tie an SD card to a Raspberry Pi?

In theory, you may be able to encrypt an SD card using the TPM so that decryption is automatic and handled by the TPM. In this scenario, it would not work on another Raspberry Pi because that Pi's TPM would not have the encryption key. A quick search implies that a TPM is either available or native to the Raspberry Pi. If it is native, this solution would be more feasible. If it is an add-on, the add-on might be stolen with the SD card, which might negate the benefit. To be clear, this is all theory, I don't know for certain whether or not a storage device can be encrypted using a TPM without having specific hardware on the storage device as well.

I want it this way if you try the SD card in another Raspberry Pi that Linux does not start or that the SD card formats itself.

Not possible, unless you can find a specialized programmable SD card that likely doesn't exist. However, it is almost never advisable to wipe encrypted data based on random rules, as the feature simply allows you to shoot yourself in the foot while a bad guy can always work around it.

Furthermore, it should not be possible to read the contents of the SD card via another PC, i.e. the data are encrypted and need a password.

If you are encrypting with TPM using a key that is stored to provide decryption automatically, there should still also be some form of recovery code that can allow the device to be read on other hardware (it may require identical hardware to be used).

Is it somehow possible that before Raspbian is started that the data on the SD card gets decrypted with the Mac address of the Pi and so a normal boot process is possible?

If you are encrpyting with TPM, the TPM would provide decryption, and serve your need since the key is tied to the TPM, but it wouldn't be related to the MAC address.

All of that having been said, if you understand these fundamentals, you can probably search for "Raspberry Pi TPM" and figure out what you need to figure out.

  • How about if I store all my data except the raspbian os on a new partition on my sd card and this partition gets encrypted. That would be far more simple right? – sirzento Jul 19 at 13:16
  • 1
    This might be more simple, but it would require password entry at boot to make it even remotely secure. Without manual entry, the password or private key would have to be stored in the boot partition, so anyone with access to the SD card would have access to decryption info. To be clear, physical access is always a security flaw to an attacker with enough resources, for instance, even if you enter a password at boot, it would theoretically be possible to access the private key in memory with physical access (in the same way it would theoretically be possible to have a custom card wipe itself). – rpseu Jul 19 at 15:51
  • That would be enough for me. I just want to be secure to the most people and maybe to someone who has basic linux knowledge. Thanks for the help :) – sirzento Jul 22 at 6:18
  • Actually, what I described was encrypting everything but the boot partition, and what you described can be achieved by mounting an encrypted partition after boot. That is far simpler and wouldn't require a password to boot, so you could even SSH in and mount the partition after reboots. – rpseu Jul 22 at 15:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.