Since JTAG can be authenticated and encrypted, which key is used? I read that Secure Boot is used, but what is the key?

Question

Since JTAG can be authenticated and encrypted, which key is used? I read that Secure Boot is used, but what is the key? Me, owner of this laptop, how can I know the key to use to access my own laptop JTAG?

Answer 1

Although the exact nature is unknown, securing the JTAG with authentication and encryption is often linked to the device’s Secire boot process. But this doesn’t mean it’s easy to find out what key is used. And often more than one key is used.

The secure boot process isn’t as simple as ‘one key,’ but let me give you a basic walkthrough.

Basically secure boot makes sure no ‘dangerous’ software runs on boot- which is a vulnerable time. It does this by verifying the digital signatures of firmware and drivers.

Like I said, there are many keys used in the secure boot process, and sometimes more than one work together.

For JTAG, if I had to guess, I’d say a symmetric key (like AES) stored in a TPM or similar secure element might encrypt JTAG communication. But I could never wrong.

The device firmware manages these keys, ensuring only authorized access.

As a laptop owner, direct access to the JTAG encryption keys is usually restricted by the OEM to maintain security.

Some devices may, and I say may, allow custom key management if secure boot is disabled, but this is really complex and device specific.

In conclusion, why it probably is possible to derive the right key, I’d not only be very hard but may compromise your laptop’s security.

These keys are secret for a reason!

Also, check out this article that explains the basics of secure boot and how it can be made more secure.

I also wanted to add, there are plenty of tools (my favourite being Impacket secretsdump: see this other article,) that can extract one of the boot keys (probably a standard symmetric encryption one,) for purposes such as accessing the SAM hive when the system is inactive.

Whether or not this is the same generic key for JTAG, I’m not sure. But I wanted to show an example of how a boot key can be extracted. But often it’s not as simple as just running a tool- especially if extra precautions have been taken for the secure boot process.