Questions tagged [secure-boot]
The secure-boot tag has no usage guidance.
23
questions
1
vote
2answers
89 views
Secure boot for devices which don't have hardware security element
I understand that Root of Trust is necessary for implementing a secure boot on a device. Root of Trust is strong and trust worthy if this comes from hardware security elements like HSM/TPM/..
So for ...
1
vote
0answers
59 views
SecureBoot: PCR to use or not
Context
I'm working on the hardening of a Debian Bullseye box.
At the moment, every works perfectly: SecureBoot enabled, "Admin" password for BIOS set, every partitions except EFI one are ...
1
vote
0answers
45 views
Security implications of automatic signing of kernel modules on Debian/Ubuntu (like VirtualBox does)
In the past, to install VirtualBox on Debian/Ubuntu you needed to sign some kernel modules, otherwise it would not work. The process involved creating a key pair, importing the public key as a MOK (...
1
vote
0answers
32 views
Restricting what hard drive can be used with a given machine
I have a machine running CentOS 7 with a removable hard drive. I want to restrict what hard drive can be used with the machine i.e. the machine can only be used with one disk and nothing else.
I've ...
0
votes
0answers
30 views
Does the TPM check the addition/removal of boot-entries
I have an issue that has been puzzling me tegarding the TPM checks on my machine, and I cannot find much documentation about the checks a TPM exactly performs. The issue is the following;
I have a ...
2
votes
2answers
540 views
Is factory reset enough to remove malware from laptop?
I have an ASUS laptop with Windows 10 that I want to factory reset. I used it for many years and did some torrenting with it in the past, so I wouldn't be surprised if something went wrong when it ...
1
vote
0answers
42 views
PKI Usage in Trusted Boot
I am trying to understand how PKI is used to boot an ARM board.
The following image relates to BL1:
The booting steps state:
Also from:
The certificate used in step 1 appears to be a content ...
1
vote
0answers
94 views
Does (UEFI) secure boot provide security advantages over TPM measured boot?
Given how UEFI secure boot appears later than TPM, i had assumption that it provides advantages over TPM.
As i read into each, it appears to me that the TPM measurements to each stage would provide ...
0
votes
1answer
80 views
What are the threats addressed by a Hardware Root-of-Trust?
SoC's have begun integrating a hardware Root-of-Trust to mitigate attacks on Secure Boot. Examples include Google's OpenTitan & Intel PFR. What are the threats addressed by discrete "Secure ...
2
votes
1answer
160 views
Understanding Secure Boot
I'm trying to understand the secure boot process of an OS but there are few points I can't wrap my head around.
At a high level, afaik, secure boot ensures that the loaded OS is authenticated by its ...
0
votes
1answer
248 views
What kind of “actions” can a TPM2 policy authorize?
I've been instructed to use the state of our system's TPM's PCR registers to prevent the system we're working on from booting if one of the PCR registers is different from what we expect. In service ...
1
vote
2answers
80 views
How do we know that input to TPMs actually comes from the measured code?
Suppose we're using secure boot and remote attestation to prove to a server what client software is talking to it.
What stops an attacker from doing this:
Start a legitimate copy of the client ...
5
votes
2answers
507 views
Is it possible to make a laptop useless to thieves?
I was robbed...
That included my Linux notebook and my company's notebook. Both are encrypted.
Mine is encrypted with LVM over LUKS, using a passphrase to unlock the hard drive once the kernel has ...
2
votes
0answers
68 views
“Trusted memory” What does it mean?
It is often cited "to load from untrusted memory to a trusted system memory" when describing the secure boot process. I wonder, when can we consider a memory as "trusted"?
0
votes
0answers
111 views
Bypassing Secure Boot in System on Chip
To bypass a secure boot for System on Chip (SoC), some attacks target the phase of copying the bootloader from where it is stored to the main memory. Instead, a malicious code will be copied to the ...
1
vote
1answer
239 views
Integrity Check on power on VS. Secure boot
Can we consider the Integrity Check on power-on and the secure boot equal from security point of view?
Secure boot is about allowing only a trusted SW to boot on the processor. A chain of trust can ...
0
votes
1answer
99 views
Is there a reasoning encrypting a GPL binary where I have to publish the sourcecode?
We're a company selling embedded devices. Our devices use u-boot & Linux, both being GPL and therefore we have to release the sourcecode as used to build our binary.
We're in the process of ...
1
vote
1answer
671 views
Why authenticated boot not Secure boot?
Context: Secure boot is one of the important elements of Trusted Computing in computer system. One variety of the Secure boot is authenticated boot. While secure boot prevent the boot of a non trusted ...
1
vote
0answers
34 views
High Availability Boot processes and only using code-signing certificates
High Availability Boot (HAB) is a technique described here in an NxP application note. This is best summarised as:
"HAB authentication is based on public key cryptography using the RSA algorithm in ...
2
votes
3answers
230 views
How much of the system is secure boot going to cover?
Background: We're developing for a Debian 9.8 system on an x86, but most of us here are more used to dealing with embedded devices.
according to wikipedia, secure boot can "secure the boot process ...
1
vote
2answers
354 views
Secure Boot - Verifying applications
I have been reading up on Secure Boot, in particular what it actually checks during the boot process.
According to Microsoft the Secure Boot process works as follows:
Firmware Boot Components: The ...
2
votes
1answer
136 views
Secure Boot - Usage of blacklist DB
I have been reading up on the details of Secure Boot, in particular the authorized and forbidden databases:
Before enabling UEFI Secure Boot (by setting the PK) the white and black lists DB & ...
1
vote
0answers
140 views
Secure way to sign virtualbox module for secure boot
I'm not sure if the Virtualbox version from the repository of my Linux distribution is already signed and works right away, but since it's not up-to-date I'm installing Virtualbox from the official ...
