Hi, I'm currently setting up a notebook, which will contain sensitive data. I want to fully encrypt the whole harddrive with luks using a keyfile encrypted with gnupg.
Since I have to leave the notebook sometimes in possible "unsecure" places, all the boot-stuff (kernel, boot-loader, initramfs, keyfile) is placed on a small USB key at my keychain. Basically that's an outsourced /boot. Now I'd like to try to use the usb-key just as a generic loader for an already encrypted kernel on the harddrive. The kernel/initramfs of the USB key loads the LUKS-partition and instead of booting this system with the already loaded kernel from the USB key it should replace the running kernel with another one incl. initramfs from the harddrive using kexec from the encrypted partition. Basically I have this setup running. One problem is, I'd have to compile kexec-tools with a non-hardened toolchain. (see bug #183062) But now I'm wondering what security implications I get by doing it this way. What for problems do you see by doing it this way? Would it be a better idea to just forget about that stuff and stay with an external /boot. Thanks! Marcel
