Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces CC (Cryptographic Companion), a novel system for Fully Authenticated Disk Encryption (FADE) that utilizes a general-purpose single-board computer, such as a Raspberry Pi, as an intermediary between a host system and an external hard disk. By performing cryptographic operations transparently, CC maintains a standard USB mass-storage interface while enhancing security against threats like malicious disk firmware. Experimental evaluations demonstrate that CC is efficient and adaptable, offering a flexible and cost-effective solution for full disk encryption without compromising performance.
A Raspberry Pi can transform external hard disks into secure, fully authenticated storage devices, enhancing encryption transparency and flexibility.
Full Disk Encryption (FDE) has become increasingly important in the last decades due to the evident confidentiality concerns. In most systems, encryption is provided by an operating system driver, through which the user can transparently access the encrypted disk after supplying the required keys (or the credentials from which those keys are derived). In this work, we explore an alternative approach: the use of an intermediate USB device placed between the host system and the external hard disk, where the encrypted data are stored. Although there are existing devices that follow this inline approach (such as RAID controllers and USB enclosures with built-in encryption), we explore the use of a general-purpose single-board computer running Linux with USB On-The-Go support (e.g. a Raspberry Pi), to provide FADE (Fully Authenticated Disk Encryption). Our system, named CC (Cryptographic Companion), performs the cryptographic operations (encryption/decryption and authentication), providing a standard USB mass-storage interface to the host (which is entirely unaware of the presence of encryption) while relying on the external USB hard disk to store the corresponding encrypted blocks. Our design provides several key advantages: flexibility, low cost, transparency, the use of generic hardware and free and open-source software, adaptability to emerging cryptographic schemes, and mitigations against malicious disk firmware. This paper presents the design and implementation of the CC and an experimental evaluation of our current research prototype, which indicates that it is sufficiently efficient for most common use cases.