3 ms·

Even if you encrypt boot partition someone could modify grub to grab password for boot partition used there. Then with that password they can evil maid again a

Even if you encrypt boot partition someone could modify grub to grab password for boot partition used there. Then with that password they can evil maid again and change your boot partition. (unless you have same password on root/boot or password is embedded in boot partition in which case win for attacker) You could detect evil maid if you add a script that does a hash over grub used to load with a salt from boot sector, show on screen for user to decide against memorised hash... Prevent perhaps secure boot with custom keys?, but then that's one more layer. And you could probably use secure boot to avoid boot partition encryption entirely.

vladvasiliu 4y ago
You can use an unencrypted /boot and have UEFI boot a unified kernel image with the kernel command line built in. And have secure boot verify the signature of that image. A TPM could possibly be helpful: you can't be sure that the PC you're booting up is actually yours and not a clone or has somehow had secure boot disabled that's booting a tampered kernel image. So if the TPM usually unlocks your drive (and a PIN, for added security) and it suddenly asks for your password, then something could be going on.