OS for key ceremony

Question

Right now I'm assembling parts and plans for a key ceremony, i.e. a procedure to generate cryptographic keys in a high security environment. In particular I want to take a laptop with coreboot (Thinkpad T60) and some smart cards with key import functionality and generate the keys on the laptop and import them into the cards to get key backup. For this task I need to choose an operating system meeting very specific requirements.

Requirements:

• The operating system must be open source

• The OS must be able to boot from a live CD

• The OS must be able to operate without persistent storage (except for a read only DVD)

• There must be a way to verify the integrity of the burned disc externally against known good values (hashes?)

• Preferably it should be able to continue operation even if the DVD is removed

• it must work with the coreboot installed T60

• it must not require more than 8GB RAM and should work with 2GB

• it must allow to (temporarily) install packages (required drivers for the cards and the card reader) from a separate disc (either in the optical boot drive or an external USB optical drive)

• it must not be larger than 4.7 GB (eg fit on a standard DVD)

Answer 1

I don't have an install of coreboot handy but I believe that ubuntu or trisquelmight be a good choice. The entirety of my answer depends on the availability of a few third party components for maximum awesomeness, but it should work.

I'm looking at a few elements here.

1. Has anyone run this distro or its derivatives on coreboot?

   • Ministry of freedom runs Trisquel on their boxen. As such, ubuntu should work since Trisquel is a 'ideologically pure' varient of Ubuntu.

2. Does it support the 'to ram' flag?

   • https://wiki.ubuntu.com/BootToRAM suggest it does since 11.0. Needs testing, and you'd need enough ram to store the OS image in ram. I'll update if I get a chance to.

3. Ubuntu will run without persistant storage, and the default installation system is a live DVD that runs off the cd.

4. Eventual availability of remastersys, which would let you 'roll in' your drivers into your live image and/or modify it easily.

5. Stock installers of most distros can check themselves iirc

Answer 2

A lot of time has passed but here's what I did anyways:

I picked Debian, essentially for the reasons outlined in Journeyman's answer but hoping Debian would be more light-weight on the RAM.

Then I made a regular install onto the hard disk of the target machine, installed all the needed drivers and stuff and then made a bootable CD / DVD from that install (using one of the many tutorials on that on the internet) which allowed me to use the standard package manager and everything and verify beforehand that it will boot from RAM.

---

Going through the requirements:

• The operating system must be open source

Debian is open-source.

• The OS must be able to boot from a live CD
• The OS must be able to operate without persistent storage (except for a read only DVD)
• Preferably it should be able to continue operation even if the DVD is removed

Debian can be loaded into RAM, just like Ubuntu.

• There must be a way to verify the integrity of the burned disc externally against known good values (hashes?)

This one's a bit more tricky, but if you check the hashes / signatures on OS installation, the OS will check the signatures of the installed packages and you can hash and verify the produced ISO (pre-boot and post-boot against the disk).

• it must work with the coreboot installed T60

I think I actually didn't use coreboot due to installation issues, but I see no reason why Debian, essentially the most-widely supported linux OS (?), shouldn't be able to work here.

• it must not require more than 8GB RAM and should work with 2GB
• it must not be larger than 4.7 GB (eg fit on a standard DVD)

Using a custom image allows to strip all the packages that are not needed for the ceremony, so RAM usage can be adjusted very well this way.

• it must allow to (temporarily) install packages (required drivers for the cards and the card reader) from a separate disc (either in the optical boot drive or an external USB optical drive)

Because it is a custom image based of a real working, tested install the drivers can be pre-inserted into the image.

Answer 3

OpenBSD or Alpinelinux, they both can be booted from a read-only medium and reside in ram only (ok, OpenBSD need more work to do that but I've been on this path some years ago and it's definitely doable). Alpinelinux is designed to run in ram, and is imho the most secure Linux distro, and OpenSC is already packaged https://pkgs.alpinelinux.org/packages?name=opensc . Oh yeah and it fits on a cdrom and needs 512 Mo of ram.