diff --git a/quorum-key-management/src/generated-documents/level-2/fixed-location/provisioner/procure-hardware.md b/quorum-key-management/src/generated-documents/level-2/fixed-location/provisioner/procure-hardware.md index db1b0e9..3974c18 100644 --- a/quorum-key-management/src/generated-documents/level-2/fixed-location/provisioner/procure-hardware.md +++ b/quorum-key-management/src/generated-documents/level-2/fixed-location/provisioner/procure-hardware.md @@ -12,6 +12,14 @@ The provisioner is responsible for procuring equipment. Their main focus is: [Guide](../../../../hardware.md#air-gapped-computer) +1. Procure hardware using the [hardware procurement and chain of custody guide](../../../../hardware-procurement-and-chain-of-custody.md) + +2. Provision AirgapOS using [this guide](../../../../one-time-use-airgapos.md) + +3. Apply [vacuum sealing + filler tamper proofing](../../../../tamper-evidence-methods.md#vacuum-sealed-bags-with-filler) to the laptop and the SD card + +4. Store the sealed package in a secure location + ### Online Machine [Guide](../../../../online-machine-provisioning.md) diff --git a/quorum-key-management/src/hardware-procurement-and-chain-of-custody.md b/quorum-key-management/src/hardware-procurement-and-chain-of-custody.md index 4737ea0..ad534a9 100644 --- a/quorum-key-management/src/hardware-procurement-and-chain-of-custody.md +++ b/quorum-key-management/src/hardware-procurement-and-chain-of-custody.md @@ -4,11 +4,11 @@ Materials and devices which are used in the context of a high assurance system need to be monitored carefully from the moment they are purchased to ensure there are no single points of failure. Going back to the assumption that participants in the system are subject to [MICE](./glossary.md#MICE) and as such may pose a threat to the system, special care has to be taken that multiple individuals are involved in the whole lifecycle of provisioning a piece of equipment. -All steps of the provisioning process need to be completed under the supervision of at least 2 individuals, but benefit from having even more individuals present to increase the number of witnesses and allow individuals to take washroom breaks, purchase food and take breaks. +All steps of the provisioning process need to be completed under the supervision of at least 2 individuals, but benefit from having even more individuals present to increase the number of witnesses and allow individuals to take washroom breaks, purchase food and take breaks. The following steps must all be completed under the continued supervision and with the involvement of all parties present. It is instrumental that there is not a single moment where the device is left unsupervised, or under the supervision of only 1 individual. -## Provisioning Hardware +## Provisioning Hardware 1. Selecting a Purchase Location @@ -37,6 +37,7 @@ Each laptop model is laid out slightly differently so use an online reference an ## Tested Hardware (AirgapOS Compatibility) * HP 13" Intel Celeron - 4GB Memory - 64GB eMMC, HP 14-dq0052dx, SKU: 6499749, UPC: 196548430192, DCS: 6.768.5321, ~USD $179.99 + * [Illustrated Parts Catalog](https://h10032.www1.hp.com/ctg/Manual/c04501162.pdf#%5B%7B%22num%22%3A3160%2C%22gen%22%3A0%7D%2C%7B%22name%22%3A%22XYZ%22%7D%2Cnull%2C732%2Cnull%5D) * Lenovo 14" Flex 5i FHD Touchscreen 2-in-1 Laptop - Intel Core i3-1215U - 8GB Memory - Intel UHD Graphics, SKU: 6571565, ~USD $379.99 diff --git a/quorum-key-management/src/one-time-use-airgapos.md b/quorum-key-management/src/one-time-use-airgapos.md index 8956d54..1c1353a 100644 --- a/quorum-key-management/src/one-time-use-airgapos.md +++ b/quorum-key-management/src/one-time-use-airgapos.md @@ -16,6 +16,8 @@ instead the AirgapOS `.iso` image is flashed to an SD card, locked using * Use the `sdtool` to lock the SD Card: + * TODO: update this to use stagex binary + * `git clone git@github.com:BertoldVdb/sdtool.git` * `cd sdtool` @@ -31,4 +33,7 @@ instead the AirgapOS `.iso` image is flashed to an SD card, locked using * Verify that the hash of `airgap.iso` matches what's flashed on the SD card: * `head -c $(stat -c '%s' out/airgap.iso) /dev/sdb | sha256sum` + * `sha256sum out/airgap.iso` + +* Commit the hash of airgap to a git repo, ensuring the commit is signed \ No newline at end of file diff --git a/quorum-key-management/src/repeat-use-airgapos.md b/quorum-key-management/src/repeat-use-airgapos.md index c0e465f..843564d 100644 --- a/quorum-key-management/src/repeat-use-airgapos.md +++ b/quorum-key-management/src/repeat-use-airgapos.md @@ -1,12 +1,13 @@ # AirgapOS Setup + This section can be completed on any machine. -AirgapOS has `keyfork` built into it for cryptographic operations such as key -derivation. +AirgapOS has `keyfork` and `icepick` built into it for cryptographic operations such as key +derivation and signing -1. Build the software according to the [readme](https://git.distrust.co/public/airgap) in the repository. Use the `make reproduce` command. +1. Build the software according to the [readme](https://git.distrust.co/public/airgap) in the repository.Use the `make reproduce` command. -2. Verify the software according to [this](verifying-signatures.md) guide +2. Verify the software according to [this guide](verifying-signatures.md) 3. Place signed .iso on a storage device @@ -29,6 +30,7 @@ derivation. ``` 4. Copy `airgap.iso` and detached signature to a storage device + a. Select a new Storage Device which has no other files on it and plug it into the machine that has the `airgap.iso` file and the detached GPG signature. @@ -38,6 +40,8 @@ derivation. e. Copy both the `airgap.iso` and detached signature to the drive. +5. Lock the SD card using `sdtool` + 5. Make sure to note the `sha256sum` hash of the `airgap.iso` and write it down on a piece of paper.