Threat Model: Evil Maid / Doctored SD Swap Risk & toram Physical Extraction Defense

[bootlace-dev]

Discussion / Issue: Evil Maid "Doctored SD Card" Defense: Run-from-RAM (toram) & Physical Media Removal

Context & Inbound Community Question:

"I almost like doing something myself though -- makes it that much less likely someone's gonna just throw together a doctored SD card that'll be similar enough that I won't notice but malicious enough to do anything. Seedsigner is great but if someone wants to hit you with a malicious SD card it's not THAT hard to swap out the malicious SD card and leave you none the wiser." (via Nostr peer review)

---

1. Problem Statement: The Evil Maid Physical Swap Attack

In devices that maintain active reads/writes from physical storage (e.g. Raspberry Pi running from an SD card, or live Linux running persistent overlays):

1. An attacker (or malicious actor with brief physical access) replaces the genuine storage card with a visually identical "doctored" SD card containing subtle seed-exfiltration or backdoored PRNG logic.
2. The user powers on the device, unaware that the physical media was swapped.
3. Even if the user built the original card themselves, they cannot visually distinguish a substituted card from their own.

---

2. SubZero Keyosk Defense Architecture

SubZero addresses the physical swap / evil maid vector through two complementary layers:

A. Run-from-RAM (toram) & Compulsory Media Ejection

1. Early Boot Init Hand-off:
   • GRUB loads the kernel and initial ramdisk from the USB/SD card.
   • The custom initramfs copies rootfs.squashfs directly into a 1GB volatile tmpfs RAM disk.
   • The init script cleanly unmounts the physical FAT32 partition and hands execution over to OpenRC via switch_root.
2. Physical Drive Extraction:
   • The user physically unplugs and removes the USB drive or SD card immediately once the TUI appears on-screen.
   • Zero Physical Media Present During Entropy Generation: When the user enters their 128 coin flips or 50 dice rolls, the physical storage medium is not even in the laptop.
   • Zero Post-Session Persistence: When the machine is powered off, volatile RAM loses charge instantly, wiping all private keys and entropy buffers.

B. Deterministic Build Verification & GPG Signatures

1. Standalone Detached GPG Signatures:
   • Every official release publishes SHA256SUMS and detached signature SHA256SUMS.asc signed by an isolated release key (567DEEEBDB2CADC1).
2. Single-Script Reproducibility:
   • Any user can re-compile the raw .img file in under 3 minutes using scripts/build_alpine_kiosk.sh inside Docker to verify byte-for-byte SHA-256 equivalence.

---

3. Threat Model Comparison: Persistent SD vs. Amnesic RAM Extraction

Attack Vector	Persistent SD / HWW Storage	SubZero Keyosk (toram)
Physical Card Swap (Pre-Boot)	Vulnerable unless hash checked on another trusted machine	Mitigated by GPG checksum verification before flashing
On-Disk Malware Implantation (Post-Boot)	Vulnerable (malware writes malicious payload or exfiltrates keys to disk partition)	Impossible (Drive is physically unplugged; storage partition is unmounted)
Post-Session Memory Extraction	Flash NAND retains written logs / traces	Impossible (Power cutoff wipes RAM; memory zeroization on exit)

---

4. Action Items & Documentation Updates

• Add explicit on-screen TUI banner prompt on Page 0: "🔒 STORAGE UNMOUNTED: You may now safely unplug the USB/SD drive before entering entropy."
• Incorporate Evil Maid / Doctored SD threat analysis into docs/TRUST_MODELS.md.