Setting up a laptop - Revision history

154pinkchairs: /* Improved method with plausible deniability */ obtaining key file path

2026-02-18T15:17:04Z

Improved method with plausible deniability: obtaining key file path

154pinkchairs: /* Getting the available ciphers */ cleaner find oneliner

2026-02-17T10:16:03Z

Getting the available ciphers: cleaner find oneliner

← Older revision		Revision as of 10:16, 17 February 2026
Line 212:		Line 212:

	To check the availability of a cipher or hash function use:		To check the availability of a cipher or hash function use:
	~~find $(~~find /lib/modules ~~-name "crypto" -type d)~~ -type f -~~name~~ "*.ko" \| sort		find /lib/modules/* -type f -path "/crypto/.ko" -exec basename {} \; \| sort

	To check if a cipher is loaded and passed its own tests use:		To check if a cipher is loaded and passed its own tests use:

154pinkchairs: /* Choosing ciphers */ grammar, duplicate "already"

2026-02-17T10:03:01Z

Choosing ciphers: grammar, duplicate "already"

← Older revision		Revision as of 10:03, 17 February 2026
Line 201:		Line 201:
	'''IMPORTANT:''' Please read the [[Setting_up_a_laptop#Important_notes \| Important notes]] section for details about the problems with AES encryption.		'''IMPORTANT:''' Please read the [[Setting_up_a_laptop#Important_notes \| Important notes]] section for details about the problems with AES encryption.

	If you don't trust AES shills and ~~endorsed by the~~ NSA, you can try another different one. Another advantage of using a public vetted cipher is that it provides confidence that it works.		If you don't trust AES shills and it's NSA endorsement, you can try another different one. Another advantage of using a public vetted cipher is that it provides confidence that it works.

	Something like KHAZAD wouldn't work on <code>cryptsetup benchmark</code>. KHAZAD itself is insecure. Wikipedia reported 5 out of 8 rounds been cracked.[https://en.wikipedia.org/wiki/KHAZAD]		Something like KHAZAD wouldn't work on <code>cryptsetup benchmark</code>. KHAZAD itself is insecure. Wikipedia reported 5 out of 8 rounds been cracked.[https://en.wikipedia.org/wiki/KHAZAD]
Line 207:		Line 207:
	For AES-128 7 out of 10, AES-192 8 out of 12, AES-256-bit 9 out 14 rounds have been cracked according to Wikipedia.[https://en.wikipedia.org/wiki/Advanced_Encryption_Standard]		For AES-128 7 out of 10, AES-192 8 out of 12, AES-256-bit 9 out 14 rounds have been cracked according to Wikipedia.[https://en.wikipedia.org/wiki/Advanced_Encryption_Standard]

	'''IMPORTANT: Do not use sha1 as the hashing algorithm.''' It already has ~~already~~ been compromised.		'''IMPORTANT: Do not use sha1 as the hashing algorithm.''' It already has been compromised.

	=== Getting the available ciphers ===		=== Getting the available ciphers ===

154pinkchairs: /* Hiding the keys using steganography */ mention stedghide being in edge/testing

2026-02-17T10:01:12Z

Hiding the keys using steganography: mention stedghide being in edge/testing

← Older revision		Revision as of 10:01, 17 February 2026
Line 81:		Line 81:
	''WARNING:'' This section is considered experimental. It requires the tool and the dependencies to be placed on another USB separate from the key files, the bootloaders, and encrypted disks. The tool and dependencies need to be packaged together. We decentralize these components so that the attacker doesn't connect the dots easily or immediately jumps to the conclusion for the requirements to decrypt. Steghide automatically uses 128-bit AES in CBC mode to encrypt data. This can be change if you don't like or trust AES with the -e option. Use <code>steghide encinfo</code> for other ciphers and modes.		''WARNING:'' This section is considered experimental. It requires the tool and the dependencies to be placed on another USB separate from the key files, the bootloaders, and encrypted disks. The tool and dependencies need to be packaged together. We decentralize these components so that the attacker doesn't connect the dots easily or immediately jumps to the conclusion for the requirements to decrypt. Steghide automatically uses 128-bit AES in CBC mode to encrypt data. This can be change if you don't like or trust AES with the -e option. Use <code>steghide encinfo</code> for other ciphers and modes.

	Fortunately, Alpine has a package for steganography called steghide. To install steghide do:		Fortunately, Alpine has a package for steganography called steghide (in the optional edge/testing repository as of February 2026). To install steghide do:

			echo "http://dl-cdn.alpinelinux.org/alpine/edge/testing" >> /etc/apk/repositories
	apk add steghide		apk add steghide

Prabuanand: moved the Todo note to more prominent place

2025-03-19T05:26:33Z

moved the Todo note to more prominent place

← Older revision		Revision as of 05:26, 19 March 2025
Line 1:		Line 1:
	This guide is about a project to create a '''secured laptop'''. For this project we take in consideration ways to extend battery life. It covers tools and daemons that are must haves for a laptop setup.		This guide is about a project to create a '''secured laptop'''. For this project we take in consideration ways to extend battery life. It covers tools and daemons that are must haves for a laptop setup.
			{{Todo\|Instructions given in the page needs testing. Please help test section by section or the entire page. If individual sections have been tested, please update the Talkpage or please move/place this notice in the untested section(s) alone.}}

	== Guide features ==		== Guide features ==
Line 23:		Line 24:
	If you did deniable encryption incorrectly, it is possible to erase and restore the header. This presents an opportunity to improve obfuscation. When you pull out the USB key, it should erase the header but store it on the USB key atomically as in completely. If you plug in the USB key, it will restore back the header. cryptsetup has luks actions luksHeaderBackup and luksHeaderRestore to do this.		If you did deniable encryption incorrectly, it is possible to erase and restore the header. This presents an opportunity to improve obfuscation. When you pull out the USB key, it should erase the header but store it on the USB key atomically as in completely. If you plug in the USB key, it will restore back the header. cryptsetup has luks actions luksHeaderBackup and luksHeaderRestore to do this.

	{{Todo\|Instructions given in the page needs testing. Please help test section by section or the entire page. If individual sections have been tested, please update the Talkpage or please move/place this notice in the untested section(s) alone.}}
	== Starting at the beginning ==		== Starting at the beginning ==

Prabuanand: added category :Category:Security replaced the Draft notice by Todo note so someone can test the page

2025-03-19T05:25:16Z

added category Category:Security replaced the Draft notice by Todo note so someone can test the page

← Older revision		Revision as of 05:25, 19 March 2025
Line 1:		Line 1:
	~~{{Draft}}~~

	This guide is about a project to create a '''secured laptop'''. For this project we take in consideration ways to extend battery life. It covers tools and daemons that are must haves for a laptop setup.		This guide is about a project to create a '''secured laptop'''. For this project we take in consideration ways to extend battery life. It covers tools and daemons that are must haves for a laptop setup.

Line 25:		Line 23:
	If you did deniable encryption incorrectly, it is possible to erase and restore the header. This presents an opportunity to improve obfuscation. When you pull out the USB key, it should erase the header but store it on the USB key atomically as in completely. If you plug in the USB key, it will restore back the header. cryptsetup has luks actions luksHeaderBackup and luksHeaderRestore to do this.		If you did deniable encryption incorrectly, it is possible to erase and restore the header. This presents an opportunity to improve obfuscation. When you pull out the USB key, it should erase the header but store it on the USB key atomically as in completely. If you plug in the USB key, it will restore back the header. cryptsetup has luks actions luksHeaderBackup and luksHeaderRestore to do this.

			{{Todo\|Instructions given in the page needs testing. Please help test section by section or the entire page. If individual sections have been tested, please update the Talkpage or please move/place this notice in the untested section(s) alone.}}
	== Starting at the beginning ==		== Starting at the beginning ==

Line 920:		Line 919:

	[[Category:Installation]]		[[Category:Installation]]
	[[category: ~~desktop~~]]		[[Category:Security]]
			[[category: Desktop]]

Sertonix: replace /etc/init.d with rc-service

2023-11-17T10:16:55Z

replace /etc/init.d with rc-service

← Older revision		Revision as of 10:16, 17 November 2023
Line 343:		Line 343:
	rc-update add dmcrypt boot		rc-update add dmcrypt boot

	==== ~~/etc/init.d/~~dmcrypt ====		==== dmcrypt ====
	The dmcrypt OpenRC service will attempt to decrypt the drive using information provided in ''/etc/conf.d/dmcrypt''.		The dmcrypt OpenRC service will attempt to decrypt the drive using information provided in ''/etc/conf.d/dmcrypt''.

Line 854:		Line 854:
	To start the services manually (or just reboot):		To start the services manually (or just reboot):

	~~/etc/init.d/~~chronyd start		rc-service chronyd start
	~~/etc/init.d/~~wpa_supplicant start		rc-service wpa_supplicant start
	~~/etc/init.d/~~dhcpcd start		rc-service dhcpcd start
	~~/etc/init.d~~ networkmanager start		rc-service networkmanager start

	== Additional tools ==		== Additional tools ==

Sertonix: /* USB key udev rule */ link to udev/eudev artical

2023-11-10T11:10:23Z

USB key udev rule: link to udev/eudev artical

← Older revision		Revision as of 11:10, 10 November 2023
Line 668:		Line 668:
	=== USB key udev rule ===		=== USB key udev rule ===

	You need to add a new udev rule that will suspend-to-ram or hibernate and log off once you pull the USB key. When you come back on, you should do 2 factor authentication to restore back everything. Hibernation and suspend-to-ram might mitigate cold-boot attack (but unlikely see notes at the bottom of the page) to extract plaintext private data and encryption keys in memory.		You need to add a new [[udev]] rule that will suspend-to-ram or hibernate and log off once you pull the USB key. When you come back on, you should do 2 factor authentication to restore back everything. Hibernation and suspend-to-ram might mitigate cold-boot attack (but unlikely see notes at the bottom of the page) to extract plaintext private data and encryption keys in memory.

	To find out the details of your USB do:		To find out the details of your USB do:

Zcrayfish: /* Important notes */ Changed hyperlink to https

2023-07-26T13:36:13Z

Important notes: Changed hyperlink to https

← Older revision		Revision as of 13:36, 26 July 2023
Line 905:		Line 905:
	By default, suspend-to-ram or hibernate will not sufficiently clear the AES encryption keys off ram in those phases which would invite a cold boot attack. This has been covered by the TRESOR kernel patch.[https://en.wikipedia.org/wiki/TRESOR][https://www1.cs.fau.de/tresor] This patch hasn't been updated since the 4.x kernel series.[https://www1.cs.fau.de/tresor]. This patch currently only works on 32-bit x86 Linux with SSE and MMX, and on processors with the AES-NI instruction set for x86_64 Linux. TRESOR doesn't work with DMA attack, but it can be mitigated by disabling DMA.[https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.303.3053&rep=rep1&type=pdf] The 32-bit version of TRESOR has only a key size of 128. The AES-NI version of TRESOR has a largest key size of 256 bit. See [[Setting_up_a_laptop#Choosing_ciphers \| Choosing ciphers]] for the number of rounds cracked.		By default, suspend-to-ram or hibernate will not sufficiently clear the AES encryption keys off ram in those phases which would invite a cold boot attack. This has been covered by the TRESOR kernel patch.[https://en.wikipedia.org/wiki/TRESOR][https://www1.cs.fau.de/tresor] This patch hasn't been updated since the 4.x kernel series.[https://www1.cs.fau.de/tresor]. This patch currently only works on 32-bit x86 Linux with SSE and MMX, and on processors with the AES-NI instruction set for x86_64 Linux. TRESOR doesn't work with DMA attack, but it can be mitigated by disabling DMA.[https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.303.3053&rep=rep1&type=pdf] The 32-bit version of TRESOR has only a key size of 128. The AES-NI version of TRESOR has a largest key size of 256 bit. See [[Setting_up_a_laptop#Choosing_ciphers \| Choosing ciphers]] for the number of rounds cracked.

	Loop-Amnesia works with LoopAES and is only for 64 bit Linux and only supports 128 bit keys but can result in data loss if their recommendations are not followed. [~~http~~://moongate.ydns.eu/amnesia.html]~~{{insecure url\|Server appears to be using a self-signed certificate}}~~		Loop-Amnesia works with LoopAES and is only for 64 bit Linux and only supports 128 bit keys but can result in data loss if their recommendations are not followed. [https://moongate.ydns.eu/amnesia.html]

	Please read the Wikipedia article on Cold Boot Attack especially the mitigation section.[https://en.wikipedia.org/wiki/Cold_boot_attack] Full disk encryption will not protect your data especially for older hardware if you do not have the proper mitigation (implying not full proof) prerequisites such as a patched kernel, memory scrambling, permanent memory module mounting for example.		Please read the Wikipedia article on Cold Boot Attack especially the mitigation section.[https://en.wikipedia.org/wiki/Cold_boot_attack] Full disk encryption will not protect your data especially for older hardware if you do not have the proper mitigation (implying not full proof) prerequisites such as a patched kernel, memory scrambling, permanent memory module mounting for example.

Witcher: Use correct service names in Wifi section

2023-07-03T19:41:39Z

Use correct service names in Wifi section

← Older revision		Revision as of 19:41, 3 July 2023
Line 847:		Line 847:
	You also need to add those services:		You also need to add those services:

	rc-update add ~~chrony~~		rc-update add chronyd
	rc-update add ~~wpa-supplicant~~		rc-update add wpa_supplicant
	rc-update add dhcpcd		rc-update add dhcpcd
	rc-update add networkmanager		rc-update add networkmanager
Line 854:		Line 854:
	To start the services manually (or just reboot):		To start the services manually (or just reboot):

	/etc/init.d/~~chrony~~ start		/etc/init.d/chronyd start
	/etc/init.d/~~wpa-supplicant~~ start		/etc/init.d/wpa_supplicant start
	/etc/init.d/dhcpcd start		/etc/init.d/dhcpcd start
	/etc/init.d networkmanager start		/etc/init.d networkmanager start

← Older revision		Revision as of 15:17, 18 February 2026
Line 290:		Line 290:
	\|-		\|-
	\| 1		\| 1
			\| Grab the previously generated key file's path. It is the one with non-zero size. Store it in a variable, e.g. <code><nowiki>KEYFILE</nowiki></code>
			\| <code><nowiki>ls -l /mnt/usb/</nowiki><code>
			\|-
			\| 2
	\| Open the ''plain dm-crypt'' device generating no metadata		\| Open the ''plain dm-crypt'' device generating no metadata
	\| <code><nowiki>cryptsetup open --type plain --cipher aes-cbc-essiv:sha256 --key-size 256 --key-file /mnt/usb/$~~(ls)~~ /dev/sda pvroot</nowiki></code>		\| <code><nowiki>cryptsetup open --type plain --cipher aes-cbc-essiv:sha256 --key-size 256 --key-file /mnt/usb/$KEYFILE /dev/sda pvroot</nowiki></code>
	\|-		\|-
	\| 2		\| 3
	\| Physical volume create with LVM		\| Physical volume create with LVM
	\| <code><nowiki>pvcreate /dev/mapper/pvroot</nowiki></code>		\| <code><nowiki>pvcreate /dev/mapper/pvroot</nowiki></code>
	\|-		\|-
	\| 3		\| 4
	\| Volume group create with LVM		\| Volume group create with LVM
	\| <code><nowiki>vgcreate vgroot /dev/mapper/pvroot</nowiki></code>		\| <code><nowiki>vgcreate vgroot /dev/mapper/pvroot</nowiki></code>
	\|-		\|-
	\| 4		\| 5
	\| Logical volume create the swap volume with LVM		\| Logical volume create the swap volume with LVM. Remember to replace 4G with your actual RAM size.
	\| <code><nowiki>lvcreate -L 4G vgroot -n swap</nowiki></code>		\| <code><nowiki>lvcreate -L 4G vgroot -n swap</nowiki></code>
	\|-		\|-
	\| 5		\| 6
	\| Logical volume create the root volume with LVM		\| Logical volume create the root volume with LVM. Also replace 2T with your physical volume size.
	\| <code><nowiki>lvcreate -L 2T vgroot -n root</nowiki></code>		\| <code><nowiki>lvcreate -L 2T vgroot -n root</nowiki></code>
	\|-		\|-
	\| 6		\| 7
	\| Logical volume create the rescue volume with LVM		\| Logical volume create the rescue volume with LVM
	\| <code><nowiki>lvcreate -L 110M vgroot -n rescue</nowiki></code>		\| <code><nowiki>lvcreate -L 110M vgroot -n rescue</nowiki></code>
	\|-		\|-
	\| 7		\| 8
	\| Format the root volume with filesystem		\| Format the root volume with filesystem
	\| <code>mkfs.ext4 /dev/mapper/vgroot-root</code>		\| <code>mkfs.ext4 /dev/mapper/vgroot-root</code>
	\|-		\|-
	\| 8		\| 9
	\| Format the swap volume and activate it		\| Format the swap volume and activate it
	\| <code>mkswap /dev/mapper/vgroot-swap && swapon /dev/mapper/vgroot-swap</code>		\| <code>mkswap /dev/mapper/vgroot-swap && swapon /dev/mapper/vgroot-swap</code>
	\|-		\|-
	\| 9		\| 10
	\| Format the rescue volume with filesystem		\| Format the rescue volume with filesystem
	\| <code>mkfs.ext4 /dev/mapper/vgroot-rescue</code>		\| <code>mkfs.ext4 /dev/mapper/vgroot-rescue</code>
	\|-		\|-
	\| 10		\| 11
	\| Create mount point for root volume		\| Create mount point for root volume
	\| <code>mkdir -p /mnt/root</code>		\| <code>mkdir -p /mnt/root</code>
	\|-		\|-
	\| 11		\| 12
	\| Mount the root volume		\| Mount the root volume
	\| <code>mount /dev/mapper/vgroot-root /mnt/root</code>		\| <code>mount /dev/mapper/vgroot-root /mnt/root</code>