Hardware Procurement

Requirements

Procedure: Local Procurement

  1. Selecting a Purchase Location

    • Select at multiple stores which carry the type of equipment being purchased, then randomly select one using the roll of a die, or other random method. This is done in order to reduce the likelihood that an insider threat is able to plant a compromised computer in a store ahead of time.

  2. Within the store, identify available adequate device

  3. Purchase the device and place it in a see-through plastic bag which will be used to transport it to a "processing location", which SHOULD be an access controlled space.

    • The bag MUST be a sealable see-through tamper evident bag. It may be necessary to remove the device from it's original packaging to fit it into the sealable bag.

  4. If the equipment does not have to be tamper proofed, simply deliver it to its storage location, and update the inventory repository with the serial number of the device.

  5. If the equipment does require tamper proofing, apply the appropriate level of tamper proofing for the security level you are performing the procurement for.

Procedure: Online Procurement

  1. Select a well known and reputable supplier. Establishing a relationship with a hardware supplier that has a reputation for privacy, supply chain security is preferred.

  2. Order the supplies to a registered mailbox, to prevent exposing your organization's location

Tamper Proofing

All hardware:

  • MUST be procured using dual custody methods

  • MUST be tamper proofed using vacuum sealing / stored in tamper evident vault

  • MUST be properly labelled

  • MUST be added to cryptographically signed inventory

Procedure

<details>
<summary>Vacuum sealing based tamper proofing</summary>

1. Insert object(s) into plastic sealing bag

1. Fill bag with enough plastic beads that most of the object is surrounded

1. Use vacuum sealer to remove air from the bag until the beads are no longer able to move

1. Take photographs of both sides of the sealed object using both the digital and polaroid camera

1. Date and sign the polaroid photographs and store them in a local lock box

1. Take the SD card to an online connected device, ensuring continued dual custody, and commit the tamper evidence photographs to a repository. If two individuals are present, have one create a PR with a signed commit, and the other do a signed merge commit.
</details>

<details>
<summary>Safe based tamper proofing</summary>

1. Place items into safe

1. Ensure the safe is properly locked
</details>

Equipment Models

Computers Models

For Level 2 security, air-gapped computers which are used for cryptographic material management and operations are required.

Computers compatiblity (for AirgapOS) can be verified using this guide

Tested models, and computers with potentially higher levels of supply chain security:

SD Cards & Adapters

SD cards can be tamper proofed in packs of 4 to reduce the amount of tamper proofing that needs to be done.

Any high quality SD equipment can be used but below are some recommended products:

1 GB is sufficient space for all Trove purposes.

Smart Cards

  • NitroKey 3

  • YubiKey 5