Anybody need full-system encryption and/or automatic Tor network routing?

[Alemarius Nexus]

Hi,

I'm currently waiting for an answer in the Imgtec boards and can't really continue to test my programs on Pandora, so I thought I'd do some other Pandora related things meanwhile.

What I'm considering is full-system encryption on Pandora using dm-crypt and LVM. I have already had some spare time and did this for my own Pandora, with a recompiled kernel and a custom initramfs that asks for a password to decrypt the root drive on boot. I also managed to decrypt it using a keycard (which, for me, kind of breaks the security of the encryption, but it's fun to script). It works quite well for me. I can't say much about speed, because I don't know how to test it reliably (don't know how meaningful results of a dd to a file on a partition that is in use are, also because of disk caching), but at least it doesn't feel any slower than without encryption.

I currently do this with an SL4P system that boots from SD card, but it should be possible to do this for SuperZaxxon too, at least when it's booting from SD card.

I've also managed to route all network traffic in this encrypted system through Tor, for paranoid users as I am sometimes.

I don't know if anybody else than me would actually like to see something like that, so: Is anybody interested in having this kind of full-system encryption for their Pandora? If so, I could write a script that uses my initramfs and recompiled kernel to install such a system to an empty SD card.

 

[quadcricket]

Full disk encryption would be very awesome. 

I know people in the hacker/security scene that would not buy a Pandora until it had easy to implement full disk encryption. 

So it would be much appreciated. I could show off to my buds at the 2600 meeting. 

(It would be even better if it was designed with /boot on a separate USB key to prevent exploitation... paranoid I know...)

 

[thatgui]

Yes Please !

Having encryption would mean finally using thunderbird for me. Maybe you could cooperate with Linux-SWAT to incorporate it into the next release ?

 

[Alemarius Nexus]

It would be even better if it was designed with /boot on a separate USB key to prevent exploitation

If you mean a USB key drive with transparent hardware encryption, that would only be possible if the Pandora could boot from USB. I don't know if that's possible right now. If you just mean a USB stick with a key file on it, I don't think that's easily possible because you need a running Linux kernel for this kind of device decryption. Maybe it's possible to load a small kernel that decrypts the boot partition of another one and hands control over to it (don't know exactly whether this works, but I think I remember reading something about that some time ago), but that would again defy security if one would modify that first kernel.

Maybe you could cooperate with Linux-SWAT to incorporate it into the next release ?

This might be an option, at least for me, but I first want to do this in a separate package because it will need some further testing.

 

[Linux-SWAT]

Write your procedure and progress here.

I plan to continue a hardening how-to, so having as much info as possible is good.

 

[Alemarius Nexus]

The procedure is actually quite easy and as I said I already have a working encrypted system. Now I just try to write a script to automatically partition the SD cards and wrap up my initramfs, and think about how I can make the process a bit easier. I have just learned it myself by reading http://en.gentoo-wiki.com/wiki/Initramfs and some of the documentation of LUKS and LVM.

In a nutshell, I encrypt an SD card partition using LUKS and place an LVM volume group into this partition with the root file system and (optionally) swap space. To boot from this partition, I recompiled the Pandora kernel with device-mapper support (including dm-crypt and LVM) and some encryption modules (AES, XTS), all compiled in statically. Then I created a custom initramfs that is loaded by the kernel on bootup, which includes statically-compiled versions of cryptsetup and the LVM tools, along with busybox, and an init script. The init script scans the SD cards for encrypted partitions and when one is found, attempts to open it with cryptsetup (either asking the user for a password or scanning for key files). LVM scans the now opened partition and I temporarily mount the root file system, then continue the real kernel boot process from this root directory. All of this is mostly independent of the actual used OS, as long as you have a supported kernel and modify the boot files a bit. I had to modify the init scripts of Slackware minimally because the LVM device nodes were not automatically created when the final system is booted and because swap space has to be reenabled after udev setup.

I will probably publish a more detailed guide on how to do this when I have finished the scripts.

 

[kingoddball]

TOR is avail for N900 - Mayve you can use some of that code, or port that over.

Works better on N900 than on my PC.

 

[Alemarius Nexus]

I think Tor in itself is already working on the Pandora. What I did is to configure Linux' netfilter to route all traffic through Tor automatically, so that you do not have to configure every program to use Tor manually. I don't know much about networking, so I did more or less blindly follow the guides on https://trac.torproject.org/projects/tor/wiki/doc/TransparentProxy. It seems to work, but I haven't tested it a lot yet (although I have been using the same process of network rerouting on a virtual machine on my notebook without any complications for some time), and it seems like ping does not work anymore now, which is a problem I'm currently ignoring.

 

[quadcricket]

One of the few ways to bypass full-disk encryption is to load a modified initramfs onto the unencrypted boot partition that records the password the user enters.

It's not a very likely attack to be honest and not likely one to be used on a Pandora since you can just simply remove the SD cards that contain your data.

If you cannot boot to USB then that makes it more complicated to create a boot partition you keep on your keychain. 

It is also worth mentioning that your Pandora will most likely be with you and your keys instead of sitting in your dorm room / apt / house / whatever waiting for someone to tinker with it. 

 

[Alemarius Nexus]

I have just released the first beta (!) version of my full-system encryption scripts/initramfs here:

http://boards.openpandora.org/index.php/topic/11367-beta-pandora-full-system-encryption/