wip for tamper proofing and chain of custody docs

ceremony

@@ -0,0 +4,4 @@
+
+    * A polaroid of the laptop tamper evidence should be carried on person at all times
+
+    * A vacuum sealer, and plastic beads will be necessary in order to be able to re-seal the laptop after use

@@ -0,0 +8,4 @@
+
+    * A polaroid and digital camera are also required
+
+2. The laptop can be left stored in a hidden location or ideally in a safe

@@ -0,0 +16,4 @@
+
+5. Unseal the laptop using the [Unsealing Procedure](tamper-evidence-methods.md#procedure)
+
+6. Follow the [coin playbook](TODO)

@@ -0,0 +1,32 @@
+# System Roles
+
+There are several roles which are required to properly operate the QKM system. While it is possible to have an individual perform multiple roles, typically they should only perform one role at a time. It is also recommended to have at least 2 individuals, or ideally the full quorum be used to make decisions pertaining to QKM.

@@ -0,0 +16,4 @@
+
+    This is done in order to reduce the likelihood that a threat actor is able to plant a compromised computer in a store.
+
+2. Within the store, identify available adequate laptops from the list of [tested hardware](#tested-hardware-airgapos-compatibility). Alternatively bring an SD card with AirgapOS, and test booting to it on the device on the store floor before purchasing it.

@@ -0,0 +18,4 @@
+
+2. Within the store, identify available adequate laptops from the list of [tested hardware](#tested-hardware-airgapos-compatibility). Alternatively bring an SD card with AirgapOS, and test booting to it on the device on the store floor before purchasing it.
+
+3. Purchase the device and place it in a see-through plastic bag which will be used to transport it to a "processing location" (TODO define processing location).

@@ -0,0 +34,4 @@
+
+5. Apply a [tamper proofing](./tamper-evidence-methods.md) method to the device depending on the [device designation](TODO)
+
+## Tested Hardware (AirgapOS Compatibility)

@@ -0,0 +18,4 @@
+
+2. Within the store, identify available adequate laptops from the list of [tested hardware](#tested-hardware-airgapos-compatibility). Alternatively bring an SD card with AirgapOS, and test booting to it on the device on the store floor before purchasing it.
+
+3. Purchase the device and place it in a see-through plastic bag which will be used to transport it to a "processing location", which is ideally just a access controlled space. The bag MUST be a sealable see-through tamper evident bag.

@@ -0,0 +30,4 @@
+
+* Microphone
+
+Each laptop model is laid out slightly differently so use an online reference and/or read the names of the components which are found in the laptop to determine which parts to remove.

@@ -0,0 +40,4 @@
+
+* Lenovo 14" Flex 5i FHD Touchscreen 2-in-1 Laptop - Intel Core i3-1215U - 8GB Memory - Intel UHD Graphics, SKU: 6571565, ~USD $379.99
+
+To ensure that hardware is compatible, it can be tested by bringing an SD card with AirgapOS loaded on it, and testing booting to a floor model in the store.

@@ -0,0 +16,4 @@
+
+    * Warranty: 1 Year
+
+    * Privacy Screen: Privacy Screen for Librem 14

@@ -0,0 +24,4 @@
+
+    * Modify the laptop as per order specifications, in this case removing radio cards.
+
+    * Seal the screws on the bottom of the laptop using glitter of chosen color

@@ -0,0 +28,4 @@
+
+    * Take photographs of the inside of the laptop, then of the outside after it's sealed
+
+    * The photographs will be signed by Purism and encrypted to the PGP key used for communications to protect the integrity of the images

@@ -0,0 +32,4 @@
+
+    * The firmware verification hardware token can be sent to a separate location from the laptop, and will be tamper sealed using tamper proofing tape 
+        
+        * TODO: find out if we can have vacuum sealing with filler as a tamper proofing method be provided by Purism

@@ -0,0 +2,4 @@
+
+This device is intended for use in a secure facility such as a [SCIF](TODO) which has the added assurances of protecting the environment from a wide range of side-channel attacks, as well as protection from physical attacks, and more comprehensive tamper proofing controls.
+
+The fixed location should include a work-station which makes it easy to perform the [tamper proofing](tamper-evidence-methods.md#tamper-proofing-station) procedure. This station may consist of a simple frame which holds a LED light, for consistent lightning, as well as a camera stand above it which can be used to take pictures. The camera should have an SD card that easily slides out of it so that the device doesn't leave and re-enter the room, only the SD card does.

@@ -0,0 +10,4 @@
+
+* Heads firmware protection (TODO link to document which explains how to set up Purism)
+
+* Glitter to prevent physical access to hardware (TODO link to how to properly use glitter for tamper proofing)

@@ -0,0 +24,4 @@
+
+2. Print photographs of tamper proofing of the laptop which will be used for the ceremony
+
+    * Both photos of vacuum sealed bar with filler and glitter on the bottom screws of laptop are required

@@ -0,0 +28,4 @@
+
+- [ ] TODO how is hardware token stored (for pureboot/heads)
+
+3. Make an entry into the access log, specifying the:

@@ -0,0 +58,4 @@
+
+{{ #include tamper-evidence-methods.md:vsbwf-procedure-sealing}}
+
+2. Remove the SD card from the camera and use chain of custody principles to ensure the integrity of the data

@@ -1,19 +1,19 @@
 # Introduction
 
-Quorum Key Management (QKM) is an open source system of playbooks and
+Quorum Vaulting System (QVM) is an open source system of playbooks and

@@ -0,0 +16,4 @@
+
+        * Ensure both primary operators have their [Operator Keys](../../../../../../glossary.md#operator-key)
+
+    * An additional operator is necessary for fetching and providing the transaction data and the latest SOL `blockhash` from a online computer and transmitting using an SD card to the 2 primary operators conducting the main ceremony

@@ -0,0 +22,4 @@
+
+    * Both operators should print photographic evidence from digital cameras which is stored in a PGP signed repository. The photographs should be of the top and underside of the vacuum sealed object.
+
+        * The operators should verify the commit signatures of the photographs they are printing against a list of permitted PGP keys

@@ -0,0 +48,4 @@
+
+    * 1 SD card with AirgapOS
+
+* Digital camera (TODO selection)

@@ -0,0 +68,4 @@
+
+{{ #include ../../../../../../secure-boot-sequence.md:content}}
+
+0. Load well known PGP keys of proposer and approver, and sign them using operator keys (NOT IMPLEMENTED)

@@ -0,0 +82,4 @@
+
+6. Tap the key
+
+7. Run `keyfork

@@ -0,0 +94,4 @@
+
+2. Get transaction request(s)
+
+    * TODO define means (could just be email?)

@@ -0,0 +96,4 @@
+
+    * TODO define means (could just be email?)
+
+3. Run `icepick workflow sol-get-blockhash-and-broadcast` command

@@ -0,0 +98,4 @@
+
+3. Run `icepick workflow sol-get-blockhash-and-broadcast` command
+
+    * Wait for prompt and plug in fresh SD card

@@ -0,0 +114,4 @@
+
+        * Wait for SD card prompt and plug in SD card with signed transaction payload
+
+2. Wait for the screen to display the transaction information. (NOT IMPLEMENTED)

@@ -0,0 +120,4 @@
+
+        * The transaction is constructed
+
+        * Signatures of tx data are verified against well known keys which were loaded by operators into local GPG keychain and signed by operators (NOT IMPLEMENTED)

@@ -0,0 +134,4 @@
+
+* The still running process from running the command to create the transaction in [Obtain Transaction Request](#obtain-transaction-request) will broadcast the transaction automatically
+
+* Await the "completed" message

@@ -0,0 +145,4 @@
+#### Sealing
+
+{{ #include ../../../../../../tamper-evidence-methods.md:vsbwf-procedure-sealing}}
+

@@ -0,0 +34,4 @@
+
+    * Colored beads
+
+* 4 SD cards (2 fresh, formatted as ext4, and 2 cards with prepared data)