I have an opensource airgapped raspberry pi project seen at the following link: www.privatekeyvault.com

I have provided a method for installing LUKS full disk encryption seen at the following: https://github.com/johnshearing/PrivateKeyVault#setup-luks-full-disk-encryption

I am trying to mitigate against a Maid in the Middle Attack explained at following: https://github.com/johnshearing/PrivateKeyVault#preventing-the-evil-maid-or-maid-in-the-middle-attack

The concern is someone could install a malware keylogger on the boot partition and collect the password when logging into the encrypted partition while still running initramfs

Once logged into my encrypted partition, I can run the following command to see the sha1sum of the boot partition: dd if=/dev/mmcblk0p1 | sha1sum

I compare this against a previously recorded sha1sum to see if the boot partition has changed. It should never change.

I want to get the sha1sum of the boot partition before logging into the encrypted partition. In other words, before providing my password. This is while I am still running under initramfs. I understand that this is folly because anyone installing a keylogger could also install a false sha1sum program so perhaps it is best to run the sha1sum command after logging into the encrypted partition where it is not possible to change the sha1sum program. Still, I am curious if it is possible to do.

The challenge is that when running the command (df), /dev/mmcblk0p1 does not show up so my command (dd if=/dev/mmcblk0p1 | sha1sum) will not work.

Any ideas how to refer to the boot partition while in initramfs?

Also, any other ideas on how to check if someone has tampered with the boot partition before logging into the encrypted partition?

Thanks for the help.

  • 1
    Very interesting but this is not really a specific question belonging to Raspberry Pi. You should ask at unix.stackexchange.com. I think you will get better answers there. But have you tried to end your linuxrc script with /bin/ash --login? Then you can inspect the situation in the ramdisk.
    – Ingo
    Dec 11, 2018 at 20:09
  • I would ask this at security.stackexchange.com
    – Fabian
    Dec 12, 2018 at 0:10
  • Thanks for the help. Will try editing the linuxrc script. Will also try the other forums. Dec 12, 2018 at 5:56
  • Also, I would like to introduce raspberry pi enthusiasts to the project. Would you please recommend an appropriate place to post. Dec 12, 2018 at 6:01


Browse other questions tagged or ask your own question.