1

I have an opensource airgapped raspberry pi project seen at the following link: www.privatekeyvault.com

I have provided a method for installing LUKS full disk encryption seen at the following: https://github.com/johnshearing/PrivateKeyVault#setup-luks-full-disk-encryption

I am trying to mitigate against a Maid in the Middle Attack explained at following: https://github.com/johnshearing/PrivateKeyVault#preventing-the-evil-maid-or-maid-in-the-middle-attack

The concern is someone could install a malware keylogger on the boot partition and collect the password when logging into the encrypted partition while still running initramfs

Once logged into my encrypted partition, I can run the following command to see the sha1sum of the boot partition: dd if=/dev/mmcblk0p1 | sha1sum

I compare this against a previously recorded sha1sum to see if the boot partition has changed. It should never change.

I want to get the sha1sum of the boot partition before logging into the encrypted partition. In other words, before providing my password. This is while I am still running under initramfs. I understand that this is folly because anyone installing a keylogger could also install a false sha1sum program so perhaps it is best to run the sha1sum command after logging into the encrypted partition where it is not possible to change the sha1sum program. Still, I am curious if it is possible to do.

The challenge is that when running the command (df), /dev/mmcblk0p1 does not show up so my command (dd if=/dev/mmcblk0p1 | sha1sum) will not work.

Any ideas how to refer to the boot partition while in initramfs?

Also, any other ideas on how to check if someone has tampered with the boot partition before logging into the encrypted partition?

Thanks for the help.

closed as off-topic by Ingo, Milliways, goldilocks Dec 11 '18 at 23:33

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be specific to the Raspberry Pi within the scope defined in the help center." – Ingo, Milliways, goldilocks
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Very interesting but this is not really a specific question belonging to Raspberry Pi. You should ask at unix.stackexchange.com. I think you will get better answers there. But have you tried to end your linuxrc script with /bin/ash --login? Then you can inspect the situation in the ramdisk. – Ingo Dec 11 '18 at 20:09
  • I would ask this at security.stackexchange.com – Fabian Dec 12 '18 at 0:10
  • Thanks for the help. Will try editing the linuxrc script. Will also try the other forums. – John Shearing Dec 12 '18 at 5:56
  • Also, I would like to introduce raspberry pi enthusiasts to the project. Would you please recommend an appropriate place to post. – John Shearing Dec 12 '18 at 6:01

Browse other questions tagged or ask your own question.