msw/CISS.debian.live.builder
SHA256
2
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 6 Wiki Activity

V8.13.432.2025.11.18
All checks were successful
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 1m23s
Details

Browse Source 
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
Marc S. Weidner
2025-11-18 16:47:36 +00:00
parent 814c552912
commit 91656bebc8
1 changed files with 11 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
docs/MAN_CISS_ISO_BOOT_CHAIN.md
View File

@@ -38,7 +38,7 @@ include_toc: true
| Hash lists | `sha512sum` format | Deterministic content verification |
| Dropbear | Modern KEX/AEAD (per `localoptions.h`) | Minimal attack surface, remote unlock |
# 5. End-to-End Boot Flow
# 5. Live ISO End-to-End Boot Flow
```mermaid
flowchart TD
subgraph Trusted HW Manufacturer
@@ -109,12 +109,13 @@ flowchart TD
# 6. LUKS/dm-integrity Layering
```mermaid
flowchart TD
A["Plain device (/live/rootfs.crypt)"] --> B["dm-integrity (HMAC-SHA-512, 4 KiB)"];
B --> C["dm-crypt (AES-XTS-512)"];
C --> D["/dev/mapper/crypt_liveiso"];
D --> E["SquashFS mount /run/live/rootfs"];
0{{"Plain device CD-ROM / USB "}} --> 1["ISO Image"];
1 --> 2["Mounting ISO FS /live/filesystem.squashfs"];
2 --> 3["Opening LUKS2 Container /live/ciss_rootfs.crypt"];
3 --> 4["Layer dm-integrity HMAC-SHA-512, 4 KiB"];
4 --> 5["Layer dm-crypt AES-XTS-512"];
5 --> 6["Mounting LUKS2 FS /dev/mapper/crypt_liveiso"];
6 --> 7["Mounting SquashFS /run/live/rootfs"];
```
**Note:** Encrypt-then-MAC at the block layer (functionally AEAD-equivalent). Any manipulation ⇒ hard I/O error.
@@ -213,7 +214,7 @@ dmsetup table --showkeys CHILD # expect integrity hmac sha512 4096
* Root FS (for 0042): `/etc/ciss/keys/<FPR>.gpg`
* **Mounts (typical):** `/run/live/rootfs`, `/run/live/overlay`
# 13. Diagram: Trust Chain & Verification Paths
# 13. Diagram: Build, Boot and Run Time Trust Chain & Verification Paths
```mermaid
flowchart TD
@@ -244,7 +245,7 @@ flowchart TD
subgraph ISO Run Time
J e09@--> K{{"CISS.debian.live.builder ISO running"}};
X{{"Boot process halted"}};
X{{"CISS.debian.live.builder Boot process halted"}};
e09@{ animation: fast }
end
@@ -253,7 +254,7 @@ G -- FAIL --> X;
I -- FAIL --> X;
```
# 14. Closing Remark
# 14. Closing Remarks
This achieves a portable, self-contained trust chain without a Microsoft-db, providing strong protection against medium tampering, bitrot and active attacks **both before and after decryption**. The dual verification phases plus `dmsetup` health make the state transparent and deterministic.