From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <wagner@tansi.org>
Received: from v6.tansi.org (ns.km31936-01.keymachine.de [87.118.116.4])
 by mail.server123.net (Postfix) with ESMTP
 for <dm-crypt@saout.de>; Sun, 19 Oct 2014 22:12:31 +0200 (CEST)
Received: from gatewagner.dyndns.org (77-57-44-24.dclient.hispeed.ch
 [77.57.44.24]) by v6.tansi.org (Postfix) with ESMTPA id DE58420DC151
 for <dm-crypt@saout.de>; Sun, 19 Oct 2014 22:12:30 +0200 (CEST)
Date: Sun, 19 Oct 2014 22:12:30 +0200
From: Arno Wagner <arno@wagner.name>
Message-ID: <20141019201230.GA2584@tansi.org>
References: <CAHeB2AnBcV3RnFc7JJ+xX7fj5NspWNBfP5-eVP4xAoUmHUUgMA@mail.gmail.com>
 <543D92A8.50701@freesources.org> <20141014215108.GA14529@tansi.org>
 <CAHeB2AnC4h16rxvtXgTuwbFW0dcf+t+HqLs3yzT+x8M8kh7h=g@mail.gmail.com>
 <m1s9m3$3q9$1@ger.gmane.org> <20141018033700.GA7735@tansi.org>
 <CAHeB2A=as_53NLAFq=J+j+mUpreh88DfkWrz-SXjWdorr2vi_g@mail.gmail.com>
 <544413AC.5040803@ramses-pyramidenbau.de>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <544413AC.5040803@ramses-pyramidenbau.de>
Subject: Re: [dm-crypt] LUKS disk encryption with remote boot authentication
List-Id: <dm-crypt.saout.de>
List-Unsubscribe: <http://www.saout.de/mailman/options/dm-crypt>,
 <mailto:dm-crypt-request@saout.de?subject=unsubscribe>
List-Archive: <http://www.saout.de/pipermail/dm-crypt/>
List-Post: <mailto:dm-crypt@saout.de>
List-Help: <mailto:dm-crypt-request@saout.de?subject=help>
List-Subscribe: <http://www.saout.de/mailman/listinfo/dm-crypt>,
 <mailto:dm-crypt-request@saout.de?subject=subscribe>
To: dm-crypt@saout.de

On Sun, Oct 19, 2014 at 21:40:28 CEST, Ralf Ramsauer wrote:
> On 10/19/14 22:13, Cpp wrote:
> > This circuitry will
> > be reponsible for physical protection i.e. safe keeping the encryption
> > key and destroy it in case an attacker tries to access it.
> > Use some epoxy to prevent easy access to RAM
> > chips... cold boot anyone?
> Erm, just my two cents, but do you *really* think that this is a threat
> to you?
> In my opinion, costs and benefits should maintain balance...
> 
> And I am quite sure that your self-made tamper safe solution will
> probably fail, if someone is really willing to break into your system.

Actually, it has a pretty good chance of working well. Once.
And if it is not too obvious and nowhere documented that the
attacker can get at beforehand.

Arno
 
> So I think ssh'ing to your system and entering the passphrase manually
> remains the best solution.
> 
> Cheers
>   Ralf
> _______________________________________________
> dm-crypt mailing list
> dm-crypt@saout.de
> http://www.saout.de/mailman/listinfo/dm-crypt

-- 
Arno Wagner,     Dr. sc. techn., Dipl. Inform.,    Email: arno@wagner.name
GnuPG: ID: CB5D9718  FP: 12D6 C03B 1B30 33BB 13CF  B774 E35C 5FA1 CB5D 9718
----
A good decision is based on knowledge and not on numbers. -- Plato

If it's in the news, don't worry about it.  The very definition of 
"news" is "something that hardly ever happens." -- Bruce Schneier