5 ms·

There's always LUKS to cover this scenario: Nuke Keys that get activated with a second password. [1] [1] https://github.com/roema/cryptsetup-nuke https://githu

There's always LUKS to cover this scenario: Nuke Keys that get activated with a second password. [1] [1] https://github.com/roema/cryptsetup-nuke https://github.com/roema/cryptsetup-nuke

boring_twenties 5y ago
The adversary can easily just copy the encrypted data before trying to decrypt it.
- brian_herman 5y ago
  I think the idea is to have them enter the password that destroys the data.
  - ratg13 5y ago
    That may have worked 10-20 years ago. These days there are established procedures and protocols that prevent this.
    - ohyeshedid 5y ago
      What protocols stop a person from removing the drive from your machine, and imaging the drive?
      - g_p 5y ago
        Not even just that - in addition to imaging, write blockers should be used for evidential integrity as well.
      - singlow 5y ago
        I think that's the point of that comment. Police have procedures now to prevent a nuke script from being effective.
      - amiga-workbench 5y ago
        If only you could run your own code on the drive controller. Start obliterating data at random if the disk isn't initialized properly.
  - boring_twenties 5y ago
    I think my point is that destroying one copy of the data is pointless when other copies exist.
    - hinkley 5y ago
      Destroying 1 copy pretty much guarantees someone is going to go find that $5 wrench and explain to you how disappointed they are.
      - staticassertion 5y ago
        If your threat model is the police, a wrench could be a best case scenario for you. If you can prove the police took a wrench to you during an interrogation you're definitely getting the case thrown out.
        dheera 5y ago
        With police you can start a Twitter mob if you're lucky but there are ten thousand other George Floyds out there that didn't get any justice when police took wrenches, tasers, knees, guns to them. And that doesn't really apply to the CBP and the CBP equivalents of other countries. They're ruthless and can lock you up in cages, there isn't really the opportunity to start a "case" until you're past the CBP. If you aren't a citizen you sadly don't have access to a lawyer if the CBP wants to hit you with a $5 wrench, because you aren't even in the US yet.
        kingcharles 5y ago
        LOL. Yes, possibly, but think of the time. I didn't break when the cops put a loaded gun to my head or threatened me and refused me a lawyer. I broke an hour later when they decided threatening my wife would be a better plan. It took 7 years of sitting in jail to get the judge to watch the video and throw shit out.
      - bduerst 5y ago
        If violence was an option in this hypothetical, it would have already been used to get the password anyway.
  - ohyeshedid 5y ago
    I think the point you responded to was talking about copying the encrypted data before attempting to unlock it.
brian_herman 5y ago
Thank you for this I've always wanted something like this.
josephcsible 5y ago
The whole concept of nuke keys is snake oil unless they're implemented with something like a TPM or HSM, since otherwise the attacker can just restore the pre-nuke image if you set it off.
- cookiengineer 5y ago
  While I agree with you with the snakeoil argument, I also have to say: TPM chips are useless because there's already tools available to listen on the SPI bus for encryption keys. [1] [2] It's only a matter of time until other key formats (other than Bitlocker) are supported. I think the only way to secure the drive is being able to write your own drive controller firmware. But even then HDD plates could be just "swapped into" another HDD. [1] https://www.saleae.com/ https://www.saleae.com/ [2] https://github.com/FSecureLABS/bitlocker-spi-toolkit https://github.com/FSecureLABS/bitlocker-spi-toolkit
  - josephcsible 5y ago
    That attack isn't relevant in this case, because it only lets you steal the keys if the TPM chooses to release them to the CPU, but if you don't know the right PIN, or use a nuke PIN, then it won't do so.
deckard1 5y ago
with LUKS you can just use a detached header stored on a USB thumb drive. Then just toss the thumb drive. But this isn't plausible deniability. You still have a hard drive in your possession and it's still covered by random data. Better deniability: always use an external drive and then distance yourself from the drive. You want plausible deniability of the entire drive to the extent that no one even suspects you of being the owner. Or, have such little sensitive data that you can use steganography to hide it in an image or video file. Just don't put the steganography tools on the same computer as the hidden data. Anything else is pretty much a joke.
doomrobo 5y ago
IANAL but I'm pretty sure this would count as destruction of evidence

There's always LUKS to cover this scenario: Nuke Keys that get activated with a second password. [1] [1] https://github.com/roema/cryptsetup-nuke https://github.com/roema/cryptsetup-nuke

boring_twenties 5y ago

The adversary can easily just copy the encrypted data before trying to decrypt it.

brian_herman 5y ago
I think the idea is to have them enter the password that destroys the data.
- ratg13 5y ago
  That may have worked 10-20 years ago. These days there are established procedures and protocols that prevent this.
  - ohyeshedid 5y ago
    What protocols stop a person from removing the drive from your machine, and imaging the drive?
    - g_p 5y ago
      Not even just that - in addition to imaging, write blockers should be used for evidential integrity as well.
    - singlow 5y ago
      I think that's the point of that comment. Police have procedures now to prevent a nuke script from being effective.
    - amiga-workbench 5y ago
      If only you could run your own code on the drive controller. Start obliterating data at random if the disk isn't initialized properly.
- boring_twenties 5y ago
  I think my point is that destroying one copy of the data is pointless when other copies exist.
  - hinkley 5y ago
    Destroying 1 copy pretty much guarantees someone is going to go find that $5 wrench and explain to you how disappointed they are.
    - staticassertion 5y ago
      If your threat model is the police, a wrench could be a best case scenario for you. If you can prove the police took a wrench to you during an interrogation you're definitely getting the case thrown out.
      - dheera 5y ago
        With police you can start a Twitter mob if you're lucky but there are ten thousand other George Floyds out there that didn't get any justice when police took wrenches, tasers, knees, guns to them. And that doesn't really apply to the CBP and the CBP equivalents of other countries. They're ruthless and can lock you up in cages, there isn't really the opportunity to start a "case" until you're past the CBP. If you aren't a citizen you sadly don't have access to a lawyer if the CBP wants to hit you with a $5 wrench, because you aren't even in the US yet.
      - kingcharles 5y ago
        LOL. Yes, possibly, but think of the time. I didn't break when the cops put a loaded gun to my head or threatened me and refused me a lawyer. I broke an hour later when they decided threatening my wife would be a better plan. It took 7 years of sitting in jail to get the judge to watch the video and throw shit out.
    - bduerst 5y ago
      If violence was an option in this hypothetical, it would have already been used to get the password anyway.
- ohyeshedid 5y ago
  I think the point you responded to was talking about copying the encrypted data before attempting to unlock it.

brian_herman 5y ago

Thank you for this I've always wanted something like this.

josephcsible 5y ago

The whole concept of nuke keys is snake oil unless they're implemented with something like a TPM or HSM, since otherwise the attacker can just restore the pre-nuke image if you set it off.

cookiengineer 5y ago
While I agree with you with the snakeoil argument, I also have to say: TPM chips are useless because there's already tools available to listen on the SPI bus for encryption keys. [1] [2] It's only a matter of time until other key formats (other than Bitlocker) are supported. I think the only way to secure the drive is being able to write your own drive controller firmware. But even then HDD plates could be just "swapped into" another HDD. [1] https://www.saleae.com/ https://www.saleae.com/ [2] https://github.com/FSecureLABS/bitlocker-spi-toolkit https://github.com/FSecureLABS/bitlocker-spi-toolkit
- josephcsible 5y ago
  That attack isn't relevant in this case, because it only lets you steal the keys if the TPM chooses to release them to the CPU, but if you don't know the right PIN, or use a nuke PIN, then it won't do so.

deckard1 5y ago

with LUKS you can just use a detached header stored on a USB thumb drive. Then just toss the thumb drive. But this isn't plausible deniability. You still have a hard drive in your possession and it's still covered by random data. Better deniability: always use an external drive and then distance yourself from the drive. You want plausible deniability of the entire drive to the extent that no one even suspects you of being the owner. Or, have such little sensitive data that you can use steganography to hide it in an image or video file. Just don't put the steganography tools on the same computer as the hidden data. Anything else is pretty much a joke.

doomrobo 5y ago

IANAL but I'm pretty sure this would count as destruction of evidence