0

I've been trying to get a reliable, and decently secure setup on a device for a little while now, and I feel like I may be overthinking some things but I am unsure.

Just to clear things up, this is mostly just for fun, and interest, so I don't exactly have a threat model that I am targeting. I am trying to find the best balance between usability and security.

Currently the setup is like this:

  • The laptop has one drive with two base partitions, boot and a dm-crypt/LUKS encrypted volume.
  • The encrypted volume has an LVM set up on it with a volume for swap, and root.
  • The encrypted volume is unlocked automatically at boot through the use of Intel PTT (Intel's TPM module within the CPU).
  • The UEFI/BIOS (including access to the boot menu) is locked with a strong password.
  • Secure boot is enabled to prevent unauthorized devices from booting on the system.

The issue that I'm having is that I realize that TPM's are not perfect for securing a system (of course nothing is necessarily perfect, mind you). There are a few simple enough attacks that can compromise them like probing the data lines of the module; however, if I understand correctly, Intel PTT, and AMD fTPM are within the CPU, so I would assume they would be immune to such attacks. However there is still of course the issue of a cold boot attack; once the keys have been released from the TPM, they are vulnerable within the RAM. And with this setup, the keys are released automatically at boot. One solution to this would be to set a boot pin, but I am trying to avoid the mild annoyance of having to input a password on boot.

What I thought might work is to also encrypt the home directory using something like fscrypt (I thought perhaps making a dedicated LUKS home partition would work, but I'm not sure its possible to unlock it at login. Please correct me if I am wrong.) so that at least the personal data is secure in the event of the device being physically compromized. But I would assume that if the device is sleeping, then the keys are still in RAM, and vulnerable in the same way as the drive keys on boot making the home encryption somewhat irrelevent, unless the device is shut down initially. However, it turned out that encrypting the home directory turned out to be somewhat of a pain (unless I am going about it in the completely wrong way) so I am wondering if it is even worth it at all.

Is the setup of just encrypting the root drive the best balance that I am going to strike? Is there any way that I can improve it that I am not aware of?

From all the reading that I have done on this endeavor, it seems that true security must be built in from the ground up, like in the iPhone. There really isn't much way to cobble together a bunch of pieces to get a truly secure and useable system. I would love it if someone could dissuade these thoughts of futility.

3
  • 3
    "don't exactly have a threat model ... best balance between usability and security" - From my understanding you don't have any actual defined requirements on both security and usability. You just feel uncomfortable with what you have since since there are known attacks against what you have - even if it is not clear if these attacks are relevant for you at all. I think you first make yourself clear what you need to protect (values), what you need to protect it against (threats) and what costs you are willing to accept (money, usability). There will always be trade-offs. May 20, 2023 at 6:37
  • I don't use Linux, so I can't answer your question. A reasonably secure setup would be Full-Disk Encryption with a Pre-Boot Authentication password or TPM+PIN. To remedy the RAM issue, you could use RAM encryption, for devices that support it (I think AMD announced a consumer CPU that supports this). Nevertheless, please have in mind that the BIOS password can, in most cases, be easily bypassed/reset. You called the TPM PIN a "mild" annoyance; to me, that is acceptable since it raises significantly the security of the system. Also, I don't think that the iPhone protects the RAM, either. Jun 12, 2023 at 22:53
  • I haven't read the 210-page document, but my guess is that the iPhone uses a secure element to store the keys and it releases them after verifying the PIN. When locked, it also possibly removes the keys from RAM and keeps two partitions in storage, one for private data and one for the application binaries, etc. The secure element+PIN is the same as TPM+PIN. I doubt that the iPhone has encrypted RAM, so the only additional measure it ahs is that it deletes the keys from RAM when locked. My comments are based on the presupposition that the system is using Secure Boot and SRTM in TPM. Jun 12, 2023 at 23:02

0

You must log in to answer this question.

Browse other questions tagged .