0

As far as I've seen, the Secure Boot process is described like so: A firmware stored in read-only memory and therefore considered secure starts. It verifies the next software component (e.g. a bootloader), loads it and - if the check is successful - passes control to it. The bootloader is now responsible for verifying the integrity of the component after that and so on.

My question is, would it be possible for the firmware to do all the checks before passing control to each component? After the verification of the bootloader, instead of running it, could the firmware continue verifying other components in the system?

What if we have more than one core available and can run multiple verifications in parallel, would this be something that the firmware could handle, and if not why?

Improve this question

2 Answers 2

Reset to default
1

Secure boot is done in stages where each one can be more complex than the other. The UEFI firmware might only know how to get the boot loader and verify its signature against a trust anchor contained in the firmware. The boot loader then can add the ability to access the OS kernel from a variety of file systems and maybe even come with its own drivers to access specific devices where the kernel is located. It also comes with the trust anchors for the next stage etc.

While in theory one could integrate all of this into a single UEFI firmware it would be very complex and would need to be continuously enhanced to add support for more file systems, device drivers, trust keys ... . The way it currently works is much more flexible and only requires some basic capabilities which are needed to load the next stage.

Improve this answer
0

The firmware for routers is often just Linux on a single chip. Depending on the size of your ROM chip and original firmware (BIOS/UEFI) you can just add a small Linux system to the chip. In case it is read only you can consider it secure. Not totally. You can't overwrite it but it may still contain bugs.

This system has more capabilities than the average firmware and you could do some easy checking of an OS image on the disk.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .