What hardware to buy for security?Best way to go about FDE? & 3-way authentication? discussion!

[HiringQubesExperts]

Hi all,

I am planning on buying a 13.3 - 15.6 laptop that I will specifically use for running qubes, and containing lots and lots of highly sensitive files.

I will also be using tor allot, and for me the main things I care about is being able to get my setup as secure as possible.

Things i've thought about so far;

OPAL SED SSD for HW based drive encryption. (Second FDE ofcourse)
USB PGP-Key for authentication and stuff., also contains (hidden) storage.
Keypad encrypted USB for hardware encrypted USB with bootfiles/keyfiles etc.

Now for the laptop itself;

Is TPM worth it? Im hearing mixed opinions... Also, I definately do not want to put all my eggs in one basket, so would using TPM be possible in a way that it is just one of several parts of the whole security-chain ? I would hate it if someone has a TPM backdoor and compromises my whole system that way, any way to design something with 2 or better yet; 3 way authentication ?

What about the processor and bios? Are there any secure/open bioses that work with recent intel processors?

As for the processor; are the SGX and other new features that skylake CPU's offer any good? Would it be possible to make use of these features in Qubes?

If not, what processor would you guys recommend? I guess Intel right? Are there any laptops out there that have onboard security-hardware that offers any real solid security benefits? I've read allot of posts from Joanna where she kinds of debunks the Cortex M-3 security chip, so I am wondering; are there any other chips like these that are truly open source, and really add some security?

What kind of laptop comes to mind when I'm asking for this kind of features? I'm having a very very hard time finding a laptop that I can setup in a way that would make me feel truly secure. I hope you guys can share some advice on these matters.

P.S.
I'm using the PGP-key stick, and USB-keypad-usb as my "extra security-weapons" are there any other reliable open source hw-security devices out there that you guys would recommend?

Would it be possible to add say some biometric security hardware and then have the full disk encryption work in such a way that 3 way authentication would be needed ?

Also, we have the software based full disk encryption, and also the HW based OPAL full disk encryption, even though I trust the software based one the most, I would still like to also maximize the security of the samsung SED based one. Would it be possible to have 3-way authentication for both, while having unique keys each?

What would be the best way to implement 3-way authentication? Most people advise me on using the combined output of all 3 hw keys, maybe even with some mechanism which unlocks a keyfile or something like that. But to me these things sound like they are not really thought trough; there has to be a better way to implement 3-way (or even 2 way) authentication, at-least for the software based FDE, and maybe even for the samsung OPAL one , right ?

Also, what would you guys recommend me to use as encryption method? LVM-LUKS won't let me encrypt the boot partition, and it wont really allow me to use 2-way authentication aswell.

What would be the best way to go about encrypting my drive using the hardware available? (PGP-key, USB-keypad, "addyourown"

I really hope we can start a discussion on these topics that will lead to a general what-should-I-buy advice when one wants maximum security from COTS hardware, and open software.

- HQE

[Matteo]

> OPAL SED SSD for HW based drive encryption. (Second FDE ofcourse)
> USB PGP-Key for authentication and stuff., also contains (hidden) storage.
> Keypad encrypted USB for hardware encrypted USB with bootfiles/keyfiles
> etc.

Be carefoul about hw encryption, usualy its crap, this research showed
that aes256 is actually a completly flawed implementation that uses rand
and can cracked in 255 attempts=istantly
"got HW crypto? On the (in)security of a Self-EncryptingDrive"
https://eprint.iacr.org/2015/1002.pdf

hidden storage is NOT POSSIBLE on usb or ssd you can encrypt but you
can't do plausible deniability, this because of wear leveling.
veracrypt manual:
https://launchpad.net/veracrypt/trunk/1.19/+download/VeraCrypt%20User%20Guide.pdf

also if you have sensitive files, remove the wifi card, microphone and
speakers and keep it offline: internet xor encryption (imho)

> Is TPM worth it? Im hearing mixed opinions... Also, I definately do not
> want to put all my eggs in one basket, so would using TPM be possible in
> a way that it is just one of several parts of the whole security-chain ?
> I would hate it if someone has a TPM backdoor and compromises my whole
> system that way, any way to design something with 2 or better yet; 3 way
> authentication ?

tpm it's just a chip that can store and reveal a value (usually a hash),
it could be backdoored but not in a way that compromise your security in
this sense: example steal keys, send things on internet.
i have read that the way that bios self-verify and send hash is flawed
too: it computed insecure hash over firs 64 bytes of each sector but i
can't remember where i have read it and hopefully not everyone do it in
that way.

> What about the processor and bios? Are there any secure/open bioses that
> work with recent intel processors?

coreboot / libreboot but i have never tried them nor i know them, i have
only read that libreboot say that it's impossible on modern cpu (intel me).

> are there any other chips like these that are truly open
> source, and really add some security?

there are opensource hw cpu but the problem is given the source and the
finished package do they match? answer: you can't prove it.
it's possible with software and has been proved for truecrypt:
https://madiba.encs.concordia.ca/~x_decarn/truecrypt-binaries-analysis/
example: 1 gate added to opensource cpu = backdoored cpu activated by
costantly dividing by 0, using javascript from remote also.
"A2: Analog Malicious Hardware"
http://static1.1.sqspcdn.com/static/f/543048/26931843/1464016046717/A2_SP_2016.pdf?token=XHNDI6aaTt1Ij2C9j%2BofnF8Fwcc%3D

> What kind of laptop comes to mind when I'm asking for this kind of
> features? I'm having a very very hard time finding a laptop that I can
> setup in a way that would make me feel truly secure. I hope you guys can
> share some advice on these matters.

get one that have intel vt-x and vt-d for virtualization tpm for
verified boot (but don't trust it 100%, if it say that something wrong
is true, if it say that everything is fine it might not be)
also second level address translation that will be required for qubes 4
if i'm not wrong

> I'm using the PGP-key stick, and USB-keypad-usb as my "extra
> security-weapons" are there any other reliable open source hw-security
> devices out there that you guys would recommend?
> Would it be possible to add say some biometric security hardware and
> then have the full disk encryption work in such a way that 3 way
> authentication would be needed ?

hw security is probably the best, if it can be verified, if not it is
probably crap (see above link for wd hhd)
also check this for harware "secure" usb:
https://spritesmods.com/?art=security
imho you should stay with known good software like truecrypt, or if you
want an updated version that might or not be secure veracrypt.
and keep in mind that pysical access always win, so keep your computer safe.
i don't trust SED devices at all, i wasn't sure about them but now that
i have read how bad is implemented by wd i know that they are less
secure than toy encryption.

> Also, what would you guys recommend me to use as encryption method?
> LVM-LUKS won't let me encrypt the boot partition, and it wont really
> allow me to use 2-way authentication aswell.

boot partition can't be encrypted, if everything is encrypted what do
you boot? (but it can be stored on separate usb key for example)

> I really hope we can start a discussion on these topics that will lead
> to a general what-should-I-buy advice when one wants maximum security
> from COTS hardware, and open software.

i hope i have helped a bit, let me know if something is not clear / missing.

Matteo

[Tai...@gmx.com]

Desktops:
Libreboot is entirely possible on a decent CPU, you can use a KGPE-D16
with a 62xx series CPU, I do that and I play the latest high end pc
games with only 25% CPU usage of 8 cores.

I am tired of people spreading mis-information, if you do not bother to
do basic research you shouldn't comment on a topic.

Laptops:
For laptops I would get a novena, it lacks IOMMU but you can use a
non-DMA capable networking device.

If you want a "mobile workstation" that isn't custom built your best
option is to get a slightly older coreboot compatible pre-FSP thinkpad
and use ME-Cleaner.

Info:
New intel and amd is entirely impossible however due to a variety of
reasons including ME/PSP.
SGX etc are things designed for DRM, they take control away from the
user who no longer has absolute authority over the device they paid for.

There is also POWER8 machines from IBM which have open firmware and easy
virtualization out of the box, although you wouldn't be running qubes as
there is only x86-64 arch available at the moment.
https://www.crowdsupply.com/raptorcs/talos - power workstation
motherboard, expensive but lots of bang for your buck, more than you
would get from intel/amd for the same price.


If you don't mind me asking what exactly are those "highly sensitive files"?

[HiringQubesExperts]

The problem is that this laptop will have to be somewhat mobile, while having atleast the performance to act as a decent hypervisor for everyday use. (will be running qubes). I was thinking about a 12-16gb ram quad core with integrated Intel Iris 5xx graphics. Single (Opal 2.0) SSD would be sufficient, as long as its 256-512gb. This would mean that I would be forced to use one of the newer intel chipsets, are these really so flawed that you would recommend against them?

What about an mobile xeon based platform? Think something like Xeon Intel® Xeon® Processor E3-1515M v5 .

Would you guys really say that modern intel processors can not be trusted enough for situations where very high security is required ?

By the way, what about intel Vpro? I heard this has some kind of backdoor in it? Some even stating there is a 3g cellular backdoor in it, but I find this hard to believe. Could someone give me some further explanation on these matters?

Lets say that I lose the laptop requirement, and go for something that acts as a server that I ssh into with my dedicated remote client, what would my possibilities be in that case?

Seems to me there is actually no high performance open-source hardware available that is truly open-source and secure....

That just makes me sad when I think about it. Oh, and the Power8 Talos project is doomed, there funding failed big time, so thats not an option neither.

Hope to get some more input on this matter.

HQE

[Tai...@gmx.com]

On 12/30/2016 08:25 PM, HiringQubesExperts wrote:

> The problem is that this laptop will have to be somewhat mobile, while
> having atleast the performance to act as a decent hypervisor for everyday
> use. (will be running qubes). I was thinking about a 12-16gb ram quad core
> with integrated Intel Iris 5xx graphics. Single (Opal 2.0) SSD would be
> sufficient, as long as its 256-512gb. This would mean that I would be
> forced to use one of the newer intel chipsets, are these really so flawed
> that you would recommend against them?
>
> What about an mobile xeon based platform? Think something like Xeon Intel®
> Xeon® Processor E3-1515M v5

> <https://ark.intel.com/products/93358/Intel-Xeon-Processor-E3-1515M-v5-8M-Cache-2_80-GHz>

> .
>
> Would you guys really say that modern intel processors can not be trusted
> enough for situations where very high security is required ?
>
> By the way, what about intel Vpro? I heard this has some kind of backdoor
> in it? Some even stating there is a 3g cellular backdoor in it, but I find
> this hard to believe. Could someone give me some further explanation on
> these matters?
>
> Lets say that I lose the laptop requirement, and go for something that acts
> as a server that I ssh into with my dedicated remote client, what would my
> possibilities be in that case?
>
> Seems to me there is actually no high performance open-source hardware
> available that is truly open-source and secure....
>
> That just makes me sad when I think about it. Oh, and the Power8 Talos
> project is doomed, there funding failed big time, so thats not an option
> neither.
>
> Hope to get some more input on this matter.
>
> HQE

Like I said you could simply buy a POWER8 server from IBM or a TYAN
Palmetto, they have free firmware out of the box and start at 3K - the
talos project is simply a regular workstation motherboard but there
isn't anything stopping you from using a POWER server as a workstation.

Before you say that 4K is expensive, you are getting quite a lot more
bang for your buck with that than with intel.

Did you listen to anything we have been saying? SE drives are bullshit.

New intel/amd is for idiots, they have ME/PSP and so they can't be
trusted, coreboot on new intel is just a shimloader layer because of FSP.

vPro is a module addon to intel ME, it provides corporate manageability
features which can include remote de-activation via an integrated or
pci-e wireless modem.
A secret 3g modem chip is impossible, the physics of it just don't make
any sense and you can't hide something like that.


Damn dude I really wanna know what you need all this security for.

[Chris Laprise]

On 12/29/2016 02:25 AM, HiringQubesExperts wrote:
> Hi all,
>
> I am planning on buying a 13.3 - 15.6 laptop that I will specifically
> use for running qubes, and containing lots and lots of highly
> sensitive files.
>
> I will also be using tor allot, and for me the main things I care
> about is being able to get my setup as secure as possible.
>
>
> Things i've thought about so far;
>
>
> OPAL SED SSD for HW based drive encryption. (Second FDE ofcourse)
> USB PGP-Key for authentication and stuff., also contains (hidden) storage.
> Keypad encrypted USB for hardware encrypted USB with
> bootfiles/keyfiles etc.
>

Hi,

FYI, OPAL should be considered inferior to regular LUKS encryption that
is protected by something like Qubes AEM. I'd say don't rely on it.

A USB drive with a keypad is fine as an extra measure, but the security
it offers is limited.

> Now for the laptop itself;
>
>
> Is TPM worth it? Im hearing mixed opinions... Also, I definately do
> not want to put all my eggs in one basket, so would using TPM be
> possible in a way that it is just one of several parts of the whole
> security-chain ? I would hate it if someone has a TPM backdoor and
> compromises my whole system that way, any way to design something with
> 2 or better yet; 3 way authentication ?
>

TPM is probably worth it, given the role Qubes Anti Evil Maid gives to
it: Stopping quick or mediocre attempts to subvert the boot process. It
raises the bar for tampering quite a bit.

> What about the processor and bios? Are there any secure/open bioses
> that work with recent intel processors?
>

Libreboot appears to work fine with some models from the Ivy Bridge (c.
2012) generation, and probably later. But AEM doesn't work with it.

> As for the processor; are the SGX and other new features that skylake
> CPU's offer any good? Would it be possible to make use of these
> features in Qubes?
>

Joanna (Qubes founder) has written articles on SGX, which can be
summed-up with this:
https://twitter.com/rootkovska/status/821298935834824704

OTOH, the TXT feature is already used in Qubes AEM.

>
> If not, what processor would you guys recommend? I guess Intel right?
> Are there any laptops out there that have onboard security-hardware
> that offers any real solid security benefits? I've read allot of posts
> from Joanna where she kinds of debunks the Cortex M-3 security chip,
> so I am wondering; are there any other chips like these that are truly
> open source, and really add some security?
>

Not really venturing into alternative architectures, a Qubes user can
try their luck with AMD. Not many have been trying, but most of them
seem successful.

However, I am a believer in the eventual necessity of an open hardware
platform for personal computing. And that probably means non-x86. OTOH,
I think the POWER8 effort was a lark... a very poor fit for potential
users and poorly conceived.

>
> What kind of laptop comes to mind when I'm asking for this kind of
> features? I'm having a very very hard time finding a laptop that I can
> setup in a way that would make me feel truly secure. I hope you guys
> can share some advice on these matters.
>

I heard the Thinkpad P series offers Xeon as an option.

In the near term for use with Qubes, I suggest not getting hung up on
raw power and instead look to the business class offerings of the
top-tier laptop makers (excluding Apple). These will tend to have a good
mix of power and security features that are properly implemented
(instead of messed-up by a bug-ridden BIOS) and have decent open-source
support. Intel i5 and i7 processors are the mainstays. Apps don't get
GPU access in Qubes, so Iris graphics won't really help. Don't pay more
than $600-700 overall.

Mobile Xeon processors are not very mobile as they require larger
housings and generate lots of heat. IMO, the one attractive feature they
have for a Qubes user is parity ECC RAM support which is more resistant
to rowhammer-type attacks.

Finally, remember that Qubes 4.0 will have additional hardware
requirements that most Qubes 3.x laptops supposedly already support, but
its generally untested. This is the main reason why I wouldn't spend a
lot on a Qubes laptop until R4 comes out.

>
> P.S.
> I'm using the PGP-key stick, and USB-keypad-usb as my "extra
> security-weapons" are there any other reliable open source hw-security
> devices out there that you guys would recommend?
>
> Would it be possible to add say some biometric security hardware and
> then have the full disk encryption work in such a way that 3 way
> authentication would be needed ?
>

It may be possible to setup 3 way auth with biometrics. You will find
that most/all business laptops that offer a TPM also include the
fingerprint reader.

> Also, we have the software based full disk encryption, and also the HW
> based OPAL full disk encryption, even though I trust the software
> based one the most, I would still like to also maximize the security
> of the samsung SED based one. Would it be possible to have 3-way
> authentication for both, while having unique keys each?
>
>
> What would be the best way to implement 3-way authentication? Most
> people advise me on using the combined output of all 3 hw keys, maybe
> even with some mechanism which unlocks a keyfile or something like
> that. But to me these things sound like they are not really thought
> trough; there has to be a better way to implement 3-way (or even 2
> way) authentication, at-least for the software based FDE, and maybe
> even for the samsung OPAL one , right ?
>
>
> Also, what would you guys recommend me to use as encryption method?
> LVM-LUKS won't let me encrypt the boot partition, and it wont really
> allow me to use 2-way authentication aswell.
>

The default Qubes method (IIRC using the default LUKS cipher), combined
with AEM, is probably the best right now. But multi-factor is a slightly
different story.... possible with AEM but not yet implemented. Here is a
regular Linux example of 2FA with LUKS:
https://twitter.com/rootkovska/status/821298935834824704

Chris

[pixel fairy]

probably a unicorn, but if you can find a laptop with the ram and/or drive soldered into the motherboard,

that also raises the bar on offline attacks. ironically, the only laptops ive found with soldered in ram are macbooks.

[Radoslaw Szkodzinski]

Hello, 

You can always solder the SODIMM board to the slot yourself, or easier, glue it in. Similar degree of security. An attacker who seizes the machine will be able to connect to signal traces anyway with a good signal analyser. This hardware measure just makes cold ram attack harder, especially the freeze and clone variant. 

Make sure to add a case opening sensor. You can make one for internal USB which can be added to many laptops. Some laptops also might have the standard 5V tampering signal pins like desktops, just unpopulated. This would take some investigation. When available, these can be read via lm-sensors and related interfaces and security measures can be taken. 

A system of a custom design is preferable.

Xen memory wiping functionality would be very useful to attach to such a script.

Additional interesting approach is a dead man USB key or using the built in camera for monitoring and alarm.

Best regards, 

Radosław 

On 2 Feb 2017 1:56 a.m., "pixel fairy" <pixel...@gmail.com> wrote:

probably a unicorn, but if you can find a laptop with the ram and/or drive soldered into the motherboard,

that also raises the bar on offline attacks. ironically, the only laptops ive found with soldered in ram are macbooks.

--
You received this message because you are subscribed to the Google Groups "qubes-devel" group.
To unsubscribe from this group and stop receiving emails from it, send an email to qubes-devel+unsubscribe@googlegroups.com.
To post to this group, send email to qubes...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-devel/f058dceb-11b4-4d9f-8e90-2809ade40d3a%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.