I have an embedded Linux system with unencrypted kernel image and initramfs in NAND flash. My RootFS is in SD card.

I want to encrypted some files on SD Card as my SD card is easily accessible physically.

For this I am planing to use eCryptfs.

But I want to keep the keys inside NAND flash in kernel image or initramfs. What are my options, what is best way to secure some files on my SD card.


If you didn't have an initramfs, you could do it with kernel parameters. Just add a random string as kernel parameter and then use /proc/cmdline as the key for your encryption. If it's not easy to add such parameters to your boot loader, the Linux kernel has a CMDLINE config option that lets you compile it in. (Note: it is possible for kernel parameters to end up in log files and such. Whether it's suitable for your scenario depends on what is running on / writing to your SD card.)

With initramfs, of course you're free to do whatever you want. It can ask for your passphrase at bootup, or include a key, or do both using encrypted keys. It's up to you but the exact implementation depends on what your initramfs looks like without such modifications. You can look at various initramfs guides online to get an idea of how it works in principle, for example: https://wiki.gentoo.org/wiki/Custom_Initramfs

You just have to be careful to not leave an unencrypted copy of the key on the SD card itself. At the same time you should have a copy somewhere since it may be hard to get it back out of the NAND if the device ever breaks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.