Best Practice for Creating and Accessing an Encrypted Database with a Strong Threat Model

Question

Goal:

I'm seeking feedback on the most secure setup for creating and accessing an encrypted database (KDBX4 format) that minimizes exposure to potential remote attacks. This database will contain highly sensitive information, and my primary focus is securing both the initial creation and subsequent access phases.

Threat Model:

The main concern is remote attacks (e.g., malware, zero-day vulnerabilities, network-based threats). Physical access threats are less of a concern as I control the physical security of my devices. My primary aim is to prevent any exposure of the database file or its encryption key to online threats. I am not concerned about brute-force attacks on the encrypted file itself, as I will use a strong KDF and a high-entropy password.

Distinct Processes: Database Creation vs. Access

Creation Process

The creation process involves setting up an isolated environment to install KeePassXC and generate the encrypted database file (KDBX4). My goal is to do this in an environment as isolated from network and remote threats as possible.

Access Process

The access process involves periodically opening the encrypted database to view or update information. My aim here is to balance security and convenience, ensuring that sensitive data can only be decrypted in a secure, preferably isolated, environment.

Setup Options for Creation

1. Airgapped Older Device (MacBook Pro)

• Process: Reformat the old MacBook, install either the latest supported macOS or a secure Linux distro, and keep it permanently airgapped.
• Database Creation: Install KeePassXC on this airgapped machine, create the encrypted database, and then transfer the database file to the intended storage location via USB.
• Advantages: Complete isolation from the internet during creation, minimizing remote attack risks.
• Concerns: Using an older device might expose it to local vulnerabilities that could theoretically compromise the database.

2. Linux Live USB Bootable Environment (Used on My Primary Online Machine)

• Process: Boot into a secure, airgapped Linux OS from a USB stick on my everyday machine. The live environment is booted to avoid lasting changes and network exposure.
• Database Creation: Install KeePassXC in the live environment, create the encrypted database, and transfer it via USB.
• Advantages: Provides isolation from the primary macOS environment during creation, without needing a separate device.
• Concerns: Booting from USB on a regularly-used online machine may expose the live environment to host-based risks.

3. Virtual Machine (VM) (Used on My Primary Online Machine)

• Process: Set up an Linux VM on my primary MacBook Pro, isolate it from host (disable network, sharing, etc), and create the database in the VM.
• Database Creation: Install KeePassXC in the VM, create the database, and transfer it to an isolated backup.
• Advantages: Easy to set up, provides some isolation from the host OS.
• Concerns: Potential risk from the macOS host if it’s compromised, as malware or vulnerabilities could affect the VM. The virtual disk where the database resides could theoretically be exposed to the host filesystem (encrypting the disk should mitigate risks).

Setup Options for Access

For access, I’d prefer a setup that allows for secure viewing and updating of the database while minimizing risk exposure. Here are the primary options I’m considering:

1. Airgapped Older Device

• Access Process: Continue to access the encrypted database on the same airgapped MacBook Pro where it was created. Data could be transferred via USB for secure storage if needed.
• Advantages: Keeps the database in a permanently offline, isolated environment for maximum security.
• Concerns: This setup requires maintaining a second device, which is less convenient.

2. Different OS booted from internal or external drive

• Access Process: Boot on a differente encrypted instances of macOS (or Linux distro), which remains offline and airgapped while accessing the database.
• Advantages: Provides isolation from the primary macOS environment each time, while being convenient enough for ad hoc access.
• Concerns: Requires rebooting the primary machine for access, which is less convenient if frequent access is needed.

3. Virtual Machine on My Primary Machine

• Access Process: Run an airgapped Linux/macOS VM to open and interact with the database.
• Advantages: Easy to open the VM when access is needed, and the VM can be isolated (the strength of the isolation is the big question here)
• Concerns: Since it’s hosted on an online primary machine, any malware on the macOS host could theoretically impact the VM’s integrity.

Storing the Encrypted Database

For backup redundancy, I’m considering storing the encrypted database file in cloud storage. My plan is to only access it in an airgapped environment, benefiting from online backup redundancy without introducing significant risk.

Questions:

1. For the initial database creation, I believe option 1 is the most secure. What will be the second best choice between option 2 (Linux live USB boot) and option 3 (VM)?
2. To install KeePassXC, I need to briefly “break” the isolation via USB or network connection. I also need to transfer the KDBX4 file for backup purposes. What’s the safest way to handle these temporary exposures, and which is preferable: USB or network connection?
3. Is my approach of storing an encrypted database online (for redundancy) and only accessing it in an isolated environment sound, or are there overlooked risks?
4. For the isolated environment—whether for creation or access—is there a recommended OS choice between Linux and macOS? Any configurations to strengthen isolation are also welcome.
5. What are the risks of using an airgapped older machine with outdated software (mainly if using macOS)?
6. If I use the least secure option for access the database (and potentially update it), does it still make sense to use the most secure option for creation?

Any advice, critiques, or recommendations on securing both creation and access processes would be greatly appreciated. Thank you!

Answer 1

Since the primary machine apparently never has to access the sensitive data, you should use completely separate, specialized hardware.

The problem of common laptops and PCs is that they're extremely complex systems with lots of hardware features which can leak information and many different places that may host malware (like the UEFI firmware). So the second option should be avoided. The third option (a VM) is even worse, because the host has unrestricted access to the memory and disks used by the VM. Disk encryption doesn't help, since the host can read any key and sabotage the encryption at any point. It's possible to protect a host from a VM to some extent, but the opposite doesn't work and makes no sense.

This leaves you with the first option. However, repurposing an old MacBook with outdated software isn't a great choice. It's again full of features you don't need and may have plenty of bugs that will never be fixed. Instead, buy something like a single-board computer with the smallest possible set of features (no ethernet adapter, no wi-fi, no S-ATA, just a few USB ports and some display output). Boot a live OS from an immutable medium like a USB stick with hardware write protection, and keep the encrypted data on another USB stick. All cryptographic operation should happen on a separate device with non-extractable keys (like a smartcard or a USB token). The described approach provides strong security and is still fairly convenient. For example, you can use the separate machine and the primary system at the same time.

KeePass isn't going to be very useful for hardware-based encryption (which you should use). You'll need tools like OpenSSL or GnuPG for this.

To answer the individual questions:

1. The second-best choice is booting a live OS from the primary system.
2. Download the necessary tools and its dependencies, check the integrity of all files (e.g., through hashes obtained from an official site via HTTPS) and then transfer the files with a USB stick to the airgapped system.
3. I don't see why you would want to break the airgap just to have a cloud backup. Simply create encrypted offline backups (e.g., on USB sticks) and keep them in different physical locations.
4. I doubt you can run macOS on arbitrary hardware.
5. Since the whole approach is very abstract at this point, it's impossible to assess the exact risks of running an outdated OS on the airgapped system. But even bugs which aren't directly security-related might damage your data.
6. No. If the data is leaked during use, then it doesn't help that it was secure at some point in the past.