I'm trying to learn more about full disk encryption (in the context of a Linux based server) and what schemes offer true security and which only offer the illusion of security.
As I understand it, most (all?) software based full disk encryption setups require some piece of software (often the boot loader) to remain unencrypted to kickoff the decryption process. The result of this is that an "Evil Maid" type attacker can replace the unencrypted piece of software with a modified version to compromise the security of the system.
I have seen a couple solutions to this problem:
/booton a flash drive which you keep with you at all times. Of course, in the context of a server, if you need to reboot while you're away, you're SOL.
- Use hardware based FDE. But, the BIOS needs to support collecting an ATA password which few do. And again, rebooting would require your physical presence to enter the password.
Which brings us to rooting Android phones. Some phones seem to be very difficult, if not impossible, to root. I know very little about the process, but why we can't just perform an Evil Maid attack on our phones? We have 100% physical control of the devices.
Obviously, it's not this simple, but what am I missing? Could the same techniques that are used to lock down Android phones be applied to a server?