On Sat, Nov 28, 2009 at 06:55:09PM -0500, Mansour Moufid wrote: > If I understand correctly, your goal is simply to ensure that the > kernel on the USB drive doesn't get tampered with? In that case, > perhaps a solution would be to keep hashes of it on that same drive, > and sign those with, say, a key on a smart card. (The FSFE offers one > along with instructions. [1]) You could verify everything at boot > time, and if there were discrepancies, custom boot scripts (kept > alongside the kernel, also hashed and signed) could prevent the > machine from booting, or something along those lines...
That's a very interesting card, but for different reasons. Since it's not integrated into the hardware of the system, it too is at the mercy of whatever the subverted kernel wants it to see. Nothing short of a hardware-integrated measurement from POST through kernel & initrd is going to guarantee (for some definition thereof) that there hasn't been some malicious modification of the process. There is vanishingly little chance that an adversary with the knowledge and motive to modify your kernel will miss whatever little userspace games you may play with hashes, kexec, or the like. It may take them a second attempt or more time than they'd like, or they may just beat you with a $5 wrench until you tell them what they want. We're not talking about casual attackers at this point, they're at least as knowledgeable as you, and typically well-financed to boot. Even so, you're far more likely to simply have your equipment stolen (which simple FDE with a strong passphrase solves) than you are to really encounter this type of threat.
