I have an unencrypted /boot partition with GRUB and an encrypted partition, where my Linux is located. An attacker, who wants to read my encrypted partition, could gain physical access to my computer and modify the unencrypted GRUB in such a way that, when I start my Linux the next time and type my encryption password, the password is directly uploaded to the internet or at least stored unencrypted to disk.
One way I thought about, how I could protect against such an attack: Before starting the computer, I could boot from a USB drive and check the integrity of the GRUB. However, this is not that simple because the GRUB changes from time to time and hence I cannot just compute a hash from the GRUB partition.
Can anyone provide other ideas?