Decryption of provisioned device

[terra-yuri]

Hi,

If I use this provision a device, and then the device malfunctions and I want to investigate it by decrypting the data - what's the process to decrypt it?

Thank you!

[tdewey-rpi]

In order to decrypt in a RMA-style situation, you must record the device private key - and this can only be done as part of initial provisioning.

Automating this is on my roadmap. If you cannot wait for that release, add an additional fastboot command before setting the LED status:

rpi-sb-provisioner/service/rpi-sb-provisioner.sh

Line 872 in b8dfe15

announce_start "Set LED status"

Add something like:

fastboot getvar private-key > ${your_secure_key_material_storage}

Then, use that key as the LUKS passphrase when you mount the storage on a host. In practice, depending on the sort of failure involved, this may require you to dismount the eMMC and re-mount it on a media accessible by another machine.

As ever - this would have you capture sensitive key material - you must take precautions to prevent unauthorised and unnecessary accesses.

[terra-yuri]

Thank you @tdewey-rpi - that's very helpful.

Is there any way to support such development to help accelerate delivery of such functionality?

[tdewey-rpi]

Thank you @tdewey-rpi - that's very helpful.

Is there any way to support such development to help accelerate delivery of such functionality?

Not directly, I'm afraid - but given your response I'm going to classify this issue as high priority, and apportion time accordingly.

[terra-yuri]

If there's GitHub Sponsors / Open Collective / etc. setup for this project I'd be happy to sponsor some further development.

Either way, thank you for the information and all the work in creating this!

[tdewey-rpi]

If there's GitHub Sponsors / Open Collective / etc. setup for this project I'd be happy to sponsor some further development.

Either way, thank you for the information and all the work in creating this!

While I appreciate the thanks, I must point out that I'm a full-time employee of Raspberry Pi, and as such the knowledge that this will help our products better meet your needs is enough.

[terra-yuri]

Thank you, will give it a try!