When we download an ISO or any file we can hash it to ensure that the downloaded file has not been tempered i.e integrity of that file is preserved.
But when I am buying a hardware device (monitor, HDD, keyboard, etc) from the market, how can I be sure that it has not been tampered with by the reseller or any malicious employee of the manufacturer?
How can we ensure the integrity of the hardware device I am buying?
The world of FIPS 140-2 certified cryptographic hardware has a similar requirement at levels 2 and 3
Devices certified to FIPS 140-2 Level 2 are required to "show evidence of tampering", which is usually accomplished by putting stickers similar to the usual "Warranty-void if removed" type stickers over screw holes and seams, but the FIPS 140-2 version of these stickers are serial numbered and like explode ink and change colours when you remove them. They are not fool-proof though and can be removed with a lot of skill and patience.
Devices certified to FIPS 140-2 Level 3 are required to have "strong enclosures and tamper-detection/response circuitry that zeroes all [cryptographic keys] when the removable covers/doors of the [device] are opened."
You tend to see this on high end servers intended for performing cryptography (ie HSMs) which run in the $1,000 - $10,000 USD range. I have never heard of this kind of tamper-evidence / tamper-resistance on consumer devices like HDDs and keyboards, but I suppose it could exist if there's a market for it?
Probably well beyond the scope of your question, but it reminds me of the field of study around Physically Unclonable Functions (PUFs) -- they are essentially hardware hash functions in the sense that they will always give the same output to the same input, but their behaviour is very hard to characterize or duplicate. These are usually complex crystals where you measure a laser's optical path, or complex electrical circuits where you measure precise latency and resistance from input pins to output pins. They are mainly used for uniqueness -- each device has a unique fingerprint -- but they also match your question that their signature will change after physical tamepring (I've heard of PUFs being built in to device casings to detect if the seal has been broken, for example).
Now, you're asking if this can be done with arbitrary consumer-grade computer parts, say a Western Digital hard drive.
**Here begins wild speculation:** Whether you can take an existing circuit and characterize its latency and resistance as a PUF, or whether you would need to build a PUF into the circuit I don't know, I'm not enough of a PUF expert. Either way, for this to work, I presume the manufacturer would need to put each device on a very high-precision machine as it comes off the assembly line, publish the results. Then you would need to buy the same testing machine, test your new hard drive, and compare the results to the published results for the serial number of your device. You couldn't build the testing device into the HDD (or even ship it in the same box) because then the attacker could just reprogram that to always display the correct result.
Bottom-line: I have never heard of the kind of tamper-resistance that you're talking about for consumer devices. In theory it's possible, but would probably significantly increase the cost of the device.
A reasonable middle-ground for the amateur tin-foil-hattist is to only buy electronics in-person off the shelf from reputable big-box stores, and never order them online where they will be shipped across the country (and possibly across international borders) with your name on the box.
