Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question may just show a distinct misunderstanding of things on my part, and I apologize if it is, but I thought I'd put it out here as I don't know where else to ask.

I've been thinking about the issues with attempting to host a fully encrypted server in a remote location - this obviously is realistically almost impossible without including the encryption key in the boot partition, or initial RAM-disk on the machine - both of these methods are far from ideal.

Then I got to thinking about how a password could be passed to a server in a remote location without having physical access. Now, the only time a computer will communicate with the network before it accesses the hard drive is during the PXE boot phase.

My question is as follows: Does anybody have any ideas how this could be utilized to supply an encryption code? Perhaps a router of some variety could pass the PXE request from a particular MAC out to an external server of some kind, which could respond with a partial or encrypted key or some kind of token which could then be used by the remote system to unlock the hard drive?

share|improve this question

migrated from Oct 10 '13 at 11:19

This question came from our site for software developers, mathematicians and others interested in cryptography.

up vote 0 down vote accepted

There´s a project called iPXE that gives you an open source network boot firmware. It can flashed on the network card or chainloaded after the default firmware is started.

You could improve it to add this functionality you describe (if I understood correctly):

  1. the remote server has everything encrypted, so need a password to start.

  2. Your customized iPXE will boot, and ask for a image from a HTTP server, by some secure communication method. Those traditional secure handshake protocols could be used.

  3. the server would validated the request and then send the boot image

  4. this boot image would decrypt the HDD and continue the boot operation

Can be done. And I think people at iPXE could enjoy it.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.