Encrypt SSD + Require USB Medium to decrypt

2

2

I want to install Windows or Linux on an external SSD (Samsung T5) and use it as an external boot medium that I can use on multiple devices including MacBooks.

I want to know the best and most secure way to encrypt the whole SSD. To decrypt it, my plan is not to use a password, rather I want to use a USB stick with a key/certificate.

So I need both the SSD and the USB stick to be able to read the data.

Edit: It would be even better if it's possible to have both a password and a keyfile to decrypt it.

Crispy

Posted 2018-06-25T08:16:29.490

Reputation: 41

What have you tried? Where are you stuck? What are you trying to achieve by keeping the decryption key on a separate device? – gronostaj – 2018-06-25T08:25:40.640

I don't understand what you want to achieve by using two separate devices. I suppose you want to make sure the external SSD is secure when unattended. You could have an additional flash drive acting as a hardware key which you always take with you and keep safe. But you could as well just take the SSD. Clearly I'm missing something, could you clarify your intentions? – gronostaj – 2018-06-25T08:38:52.797

Regular Windows does not support booting off USB drives. – Daniel B – 2018-06-25T09:05:52.310

Why did you remove the original question? – Dominique – 2018-06-28T07:36:37.413

Could just use any linux live USB + some encrypted data (folder or partition) – Xen2050 – 2018-06-29T23:04:44.720

Answers

0

Your question is probably too broad for an answer of reasonable length, but here are some pointers:

You want to go with Linux. Windows doesn't like being transplanted to other machines. You'll also want to use UEFI boot, not BIOS boot. This is the most portable solution right now.

Use LUKS for full disk encryption on the root partition (/) stored on the SSD. Place unencrypted /boot partition on the flash drive. Your key is on the same device anyway, so there's no point in encrypting any data stored there. ESP (EFI System Partition) should also be stored on the flash drive. Install GRUB on it; it will be the boot entry point.

ESP and /boot are elements of the boot chain, so never leave the flash drive unattended. Once it happens, you have to consider the boot chain compromised - ESP and /boot may have been tampered. /boot could be encrypted with additional password to prevent that, but ESP cannot be encrypted. So if you suspect flash drive could be compromised, but the SSD is in a safe location, you have to:

  1. Find a trusted Linux machine.
  2. Nuke ESP and /boot, then recreate them from a safe backup or rebuild from scratch.
  3. Generate new encryption keys and cryptsetup-reencrypt the SSD.

The unencrypted ESP problem could be mitigated by:

  1. Signing the boot files with your private key
  2. Password-protecting UEFI to prevent tampering with signature databases
  3. Updating UEFI signature databases to contain only your public key
  4. Enabling Secure Boot to prevent booting from unsigned binaries
  5. Signing kernel and initrd
  6. Building a standalone signed GRUB binary with embedded config and kernel signature enforcement

You can't do that, though, because you want your setup to not be limited to any physical machine.

gronostaj

Posted 2018-06-25T08:16:29.490

Reputation: 33 047

Encrypted /boot on SSD would be nice, but the kernel and initrd must be accessible for GRUB. GRUB does support booting from encrypted partitions, but in my experience it's quite cumbersome to set up and I'm not sure if GRUB supports using keyfiles for decryption. Unencrypted /boot on SSD would defeat the purpose of this entire setup, anyone with physical access to SSD could plant a rogue boot chain. Same with ESP, and it just cannot be encrypted. My solution is to move all the critical boot stuff to a device that's supposed to be secure anyway. – gronostaj – 2018-06-25T10:29:42.590

Re your edited comment: computer's firmware (UEFI) needs some unencrypted entry point to kick off the boot procedure. Unencrypted = prone to tampering => cannot be trusted. The regular solution would be to enforce signature checks on everything in the boot chain, but you can't do that because you want portability. Therefore you have to keep your boot chain on a separate, secure device. – gronostaj – 2018-06-25T10:34:54.317

(My comments are a reply to @user917513's deleted comment which asked if it's possible to use the flash drive just for encryption key) – gronostaj – 2018-06-28T07:42:29.230

Asked: 2018-06-25T08:16:29.490

Viewed: 612 times

Active: 2018-06-28T07:38:10.137