From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from v6.tansi.org (ns.km31936-01.keymachine.de [87.118.116.4]) by mail.server123.net (Postfix) with ESMTP for ; Mon, 20 Oct 2014 00:10:46 +0200 (CEST) Received: from gatewagner.dyndns.org (77-57-44-24.dclient.hispeed.ch [77.57.44.24]) by v6.tansi.org (Postfix) with ESMTPA id 3DB8C20DC151 for ; Mon, 20 Oct 2014 00:10:46 +0200 (CEST) Date: Mon, 20 Oct 2014 00:10:45 +0200 From: Arno Wagner Message-ID: <20141019221045.GA3633@tansi.org> References: <543D92A8.50701@freesources.org> <20141014215108.GA14529@tansi.org> <20141018033700.GA7735@tansi.org> <544413AC.5040803@ramses-pyramidenbau.de> <20141019201230.GA2584@tansi.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Subject: Re: [dm-crypt] LUKS disk encryption with remote boot authentication List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: dm-crypt@saout.de On Sun, Oct 19, 2014 at 22:59:21 CEST, Cpp wrote: > On 10/19/14, Arno Wagner wrote: > > Actually, it has a pretty good chance of working well. Once. > > And if it is not too obvious and nowhere documented that the > > attacker can get at beforehand. > > So basically if a device like this is meant to be used and distributed > widely, one security requirement would be that each and every device > uses a custom anti-tampering circuitry setup so that no two setups are > identical. After one device has been compromised, a new custom setup > has to be made, possibly at a new location. For DIY, yes. Commercial HSMs have another protection, namely they are priced at EUR 50k+. That discourages most attackers from buying a few to leant how to break into them. But seriously, this is not a beginner's game. If you want to keep out a low-resource attacker, just get a safe, drill some holes for the cables, add an arduino or compatible with light, vibration and orientation sensors and make it protect the passphrase and pull the plug if it finds something fishy. Attachment to computer via serial or USB as HID is fine. Arno -- Arno Wagner, Dr. sc. techn., Dipl. Inform., Email: arno@wagner.name GnuPG: ID: CB5D9718 FP: 12D6 C03B 1B30 33BB 13CF B774 E35C 5FA1 CB5D 9718 ---- A good decision is based on knowledge and not on numbers. -- Plato If it's in the news, don't worry about it. The very definition of "news" is "something that hardly ever happens." -- Bruce Schneier