5

What's the exact difference between secure boot and device attestation. Nowadays with secure devices both are used, even at the same time, when in the core they do similar things, which is verification of the software running on the platform.

Improve this question
1
  • 4
    Secure Boot is a specific UEFI technology from Microsoft, whereas attestation is a general technique done by extending PCRs in TPM hardware to verify the state of firmware, bootloader, etc. Not an answer because this is such a brief explanation.
    – forest
    Nov 30, 2018 at 8:05

1 Answer 1

Reset to default
4

While both of them aim for verifying the authenticity of one or multiple software component(s), they are totally different mechanisms and that is why, as you mentioned, they are both deployed in the same time in some platform.

Here I give a platform-agnostic comparison between the two concepts:

Secure boot:

  • is allowing only a trustworthy sw to be executed. => it verifies the software which is expected to run on the device.

  • Secure boot is conducted during the boot process of the device (just after the power up).

  • Secure boot propagates the trust from one software component to an other which results in building a chain of trust.

Remote attestation:

  • a host platform attests a verifying platform about the trustworthiness of the SW running on that host platform. => verification of a software which is already running

  • is usually done in a post-boot process.

  • measurements to be used in the attestation protocol are generated during the Secure Boot process.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .