I am using a BeagleBone Black board running Debian.
My intention is to create a separate encrypted partition to store private keys in the internal emmc. The keys are used for SSL communication. The main intention of course is to keep the keys secure so nobody can read them. I know that using a TPM or HSM is the right solution this , but I want to see if I can do something without one and just store the keys in normal flash.
The reason I need a separate partition is that sometimes I will want to completely upgrade the Linux OS on the device by over-writing the current image on one partition. I will not want to affect the private keys stored this way, and the new OS should be able to access the keys in the same way as the last one from the separate partition. Is this a common way to go about it?
Would dm-crypt work for this? I don't understand however how this works on the low-level. Will the new Linux OS in which I install be able to decrypt my private partition in the same way the previous Linux did? What is to stop anybody from decrypting and viewing my private keys if they hacked into the device?