diff --git a/quorum-key-management/src/generated-documents/level-2/fixed-location/provisioner/procure-hardware.md b/quorum-key-management/src/generated-documents/level-2/fixed-location/provisioner/procure-hardware.md index 7bba3bb..66dc539 100644 --- a/quorum-key-management/src/generated-documents/level-2/fixed-location/provisioner/procure-hardware.md +++ b/quorum-key-management/src/generated-documents/level-2/fixed-location/provisioner/procure-hardware.md @@ -69,7 +69,7 @@ SD cards don't require special chain of custody, but ideally should be purchased ### Polaroid camera {{ #include ../../../../tamper-evidence-methods.md:polaroid-cameras}} -## AirgapOS +## AirgapOS (SD Card) An SD card with AirgapOS written to it will be required to run ceremonies. @@ -77,7 +77,7 @@ The AirgapOS SD Card once provisioned will be used in creating the [tamper proof {{ #include ../../../../one-time-use-airgapos.md:steps }} -### Shardfile +### Shardfile (SD Card) There should be multiple SD cards containing the shardfile data. Shardfile data is produced during a [Root Entropy](todo) derivation ceremony. @@ -85,15 +85,14 @@ The Shardfile SD Card once provisioned will be used in creating the [tamper proo * Label: "Shardfile" - -## Trusted Keys - -### Procedure +## Trusted Keys (SD Card) This procedure requires 2 individuals in order to witness the process and verify that the data being burned to the card is correct. The Trusted Keys SD Card once provisioned will be used in creating the [tamper proofed airgap bundle](#air-gapped-bundle) +### Procedure + 1. Get a freshly formatted SD card 1. Plug it into a computer @@ -116,13 +115,17 @@ The Trusted Keys SD Card once provisioned will be used in creating the [tamper p For [Level 2](../../../../threat-model.md#level-2) security, air-gapped computers which are used for cryptographic material management and operations are required. +Sealable plastic bag is required for this procedure: + +{{ #include ../../../../hardware-models.md:sealable-plastic-bags }} + ### Models {{ #include ../../../../hardware-models.md:computer-models }} ### Procedure -1. Follow the [chain of custody procurement procedure](../../../../hardware-procurement-and-chain-of-custody.md) +{{ #include ../../../../hardware-procurement-and-chain-of-custody.md:steps}} ## Air-gapped bundle diff --git a/quorum-key-management/src/hardware-models.md b/quorum-key-management/src/hardware-models.md index a1b5e5d..1cdf03b 100644 --- a/quorum-key-management/src/hardware-models.md +++ b/quorum-key-management/src/hardware-models.md @@ -38,11 +38,8 @@ ## Tamper Proofing -* Sealable See-Through Bags - - * [Alert Security bag](https://shop.alertsecurityproducts.com/clear-alert-bank-deposit-bag-15-x-20-250cs?affiliate=ppc12&gad_source=1&gclid=CjwKCAiAgoq7BhBxEiwAVcW0LJoCVUqYI1s4RGoctHxMwtmNlwenDhgP_0x4gjB9W2e4f_7tzdJ_rxoCOwMQAvD_BwE) - - - +// ANCHOR: sealable-plastic-bags +[Alert Security bag](https://shop.alertsecurityproducts.com/clear-alert-bank-deposit-bag-15-x-20-250cs?affiliate=ppc12&gad_source=1&gclid=CjwKCAiAgoq7BhBxEiwAVcW0LJoCVUqYI1s4RGoctHxMwtmNlwenDhgP_0x4gjB9W2e4f_7tzdJ_rxoCOwMQAvD_BwE) +// ANCHOR_END: sealable-plastic-bags /* ANCHOR_END: all */ \ No newline at end of file diff --git a/quorum-key-management/src/hardware-procurement-and-chain-of-custody.md b/quorum-key-management/src/hardware-procurement-and-chain-of-custody.md index cafa3e4..f7a93ef 100644 --- a/quorum-key-management/src/hardware-procurement-and-chain-of-custody.md +++ b/quorum-key-management/src/hardware-procurement-and-chain-of-custody.md @@ -1,3 +1,4 @@ +/* ANCHOR: all */ # Procurement & Chain of Custody ## Provisioning Chain of Custody @@ -9,7 +10,7 @@ All steps of the provisioning process need to be completed under the supervision The following steps must all be completed under the continued supervision and with the involvement of all parties present. It is instrumental that there is not a single moment where the device is left unsupervised, or under the supervision of only 1 individual. ## Provisioning Hardware - +// ANCHOR: steps 1. Selecting a Purchase Location * Select at least 4 stores which carry the type of equipment being purchased, then randomly select one using the roll of a die, or other random method. This is done in order to reduce the likelihood that a threat actor is able to plant a compromised computer in a store ahead of time. @@ -23,7 +24,5 @@ The following steps must all be completed under the continued supervision and wi 4. If the equipment does not have to be tamper proofed, simply deliver it to its storage location, and update the inventory repository with the serial number of the device. 5. If the equipment does require tamper proofing, apply the appropriate level of tamper proofing for the security level you are performing the procurement for. - -## Tested Hardware (AirgapOS Compatibility) - -{{ #include hardware-models.md:computer-models }} +// ANCHOR_END:steps +/* ANCHOR_END: all */ \ No newline at end of file