0

I had an idea about having an encrypted partition on the Pi's SD card which can be auto-decrypted with a headless setup (no keyboard available for manual decryption).

Would it not be possible to create a script that tests GPIO pins after boot and 'assembles' a password from the state of the pins which is then used to decrypt the partition? This way, there's no keyfile or password or anything stored on the SD card and you can remove a jig from the GPIO to prevent decryption and secure your data.

0

Yes, that is possible.

You will have to construct the encrypted partition yourself to be separate from the partitions created by the operating system you want to use.

0

I am using encryption on my SSD with Pi but the idea of automatic decryption based on the combination of your GPIO pins state is ... a bit against your encryption. It will be enough if someone checks your script that is checking this combination and... encryption is gone ;-) LUKS encryption allows you to use either password or the keyfile so to be able to decrypt remotely (headless) you need to store the keyfile on your Pi. Anybody who can get into your Pi once he analysed your scripts can find out where the keyfile is and apply it. Even if you write some script that listens/waits for proper "decrypt message" it will have to apply the keyfile (you would not send the password I assume) - again: I don't see how to make it secure in case someone gets into your Pi. I was testing automatic decryption with Telegram bot but they only way was to use the keyfile. Of course, you could send the file from remote host, use it for decryption (opening the drive) and then delete it. Btw let me know please how you solve it as I would be interested in it as well ;-)

1
  • I'm not certain that I understand your point fully. Yes. encrypting the Pi with a keyfile is pointless because anyone could find & apply it. It's also true that they could find my startup script and discover how it works, but the script doesn't use a keyfile or store a password. It would 'build' a password from the state of the GPIO pins. If you removed the GPIO jig, the script would build the wrong password and the decrytion would fail - protecting your data. This way, a keyboard is also not required so the Pi can be headless. Jul 5 at 12:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.