3 ms·

You may want to take a look at tboot: http://tboot.sourceforge.net/ http://tboot.sourceforge.net/ tboot is a version of grub modified to perform a TPM-measured

You may want to take a look at tboot: http://tboot.sourceforge.net/ http://tboot.sourceforge.net/ tboot is a version of grub modified to perform a TPM-measured launch of the OS. It's not sufficient by itself to do what you want, but you could build on that by, say, sealing a volume encryption key under that measurement, such that if the boot loader is modified, virtualized, etc., it won't be able to decrypt the volume. (Or less aggressively, sealing a user-secret that is displayed at the grub-menu, allowing you to verify the above, but not completely hosing you if the measurement changes unexpectedly due to a software upgrade etc.)

jonthedge 14y ago
Another option is the "Trusted GRUB" patch: http://trousers.sourceforge.net/grub.html http://trousers.sourceforge.net/grub.html tboot as described above requires your system (CPU & chipset dependencies above and beyond the TPM) to support Intel's "Trusted Execution Technology". See, e.g., http://ark.intel.com/search/advanced/?s=t&TXT=true http://ark.intel.com/search/advanced/?s=t&TXT=true In either case, you end up with a record (cryptographic hash chain) of what kernel + initrd + config options in some of the TPM's PCRs (Platform Configuration Registers). I'm not aware of any existing software to protect your FDE (full disk encryption) key by "sealing" (a TPM operation) under those PCRs (i.e., decryption impossible unless they match) and unsealing at boot time, but many of the tricky components already exist as open-source projects. See also: http://trustedjava.sourceforge.net/ http://trustedjava.sourceforge.net/