I have an opensource airgapped raspberry pi project seen at the following link: www.privatekeyvault.com
I have provided a method for installing LUKS full disk encryption seen at the following: https://github.com/johnshearing/PrivateKeyVault#setup-luks-full-disk-encryption
I am trying to mitigate against a Maid in the Middle Attack explained at following: https://github.com/johnshearing/PrivateKeyVault#preventing-the-evil-maid-or-maid-in-the-middle-attack
The concern is someone could install a malware keylogger on the boot partition and collect the password when logging into the encrypted partition while still running initramfs
Once logged into my encrypted partition, I can run the following command to see the sha1sum of the boot partition: dd if=/dev/mmcblk0p1 | sha1sum
I compare this against a previously recorded sha1sum to see if the boot partition has changed. It should never change.
I want to get the sha1sum of the boot partition before logging into the encrypted partition. In other words, before providing my password. This is while I am still running under initramfs. I understand that this is folly because anyone installing a keylogger could also install a false sha1sum program so perhaps it is best to run the sha1sum command after logging into the encrypted partition where it is not possible to change the sha1sum program. Still, I am curious if it is possible to do.
The challenge is that when running the command (df), /dev/mmcblk0p1 does not show up so my command (dd if=/dev/mmcblk0p1 | sha1sum) will not work.
Any ideas how to refer to the boot partition while in initramfs?
Also, any other ideas on how to check if someone has tampered with the boot partition before logging into the encrypted partition?
Thanks for the help.