Questions tagged [secure-boot]

The tag has no usage guidance.

11 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
2
votes
0answers
68 views

“Trusted memory” What does it mean?

It is often cited "to load from untrusted memory to a trusted system memory" when describing the secure boot process. I wonder, when can we consider a memory as "trusted"?
2
votes
3answers
233 views

How much of the system is secure boot going to cover?

Background: We're developing for a Debian 9.8 system on an x86, but most of us here are more used to dealing with embedded devices. according to wikipedia, secure boot can "secure the boot process ...
1
vote
0answers
66 views

SecureBoot: PCR to use or not

Context I'm working on the hardening of a Debian Bullseye box. At the moment, every works perfectly: SecureBoot enabled, "Admin" password for BIOS set, every partitions except EFI one are ...
1
vote
0answers
48 views

Security implications of automatic signing of kernel modules on Debian/Ubuntu (like VirtualBox does)

In the past, to install VirtualBox on Debian/Ubuntu you needed to sign some kernel modules, otherwise it would not work. The process involved creating a key pair, importing the public key as a MOK (...
1
vote
0answers
32 views

Restricting what hard drive can be used with a given machine

I have a machine running CentOS 7 with a removable hard drive. I want to restrict what hard drive can be used with the machine i.e. the machine can only be used with one disk and nothing else. I've ...
1
vote
0answers
47 views

PKI Usage in Trusted Boot

I am trying to understand how PKI is used to boot an ARM board. The following image relates to BL1: The booting steps state: Also from: The certificate used in step 1 appears to be a content ...
1
vote
0answers
101 views

Does (UEFI) secure boot provide security advantages over TPM measured boot?

Given how UEFI secure boot appears later than TPM, i had assumption that it provides advantages over TPM. As i read into each, it appears to me that the TPM measurements to each stage would provide ...
1
vote
0answers
36 views

High Availability Boot processes and only using code-signing certificates

High Availability Boot (HAB) is a technique described here in an NxP application note. This is best summarised as: "HAB authentication is based on public key cryptography using the RSA algorithm in ...
1
vote
0answers
143 views

Secure way to sign virtualbox module for secure boot

I'm not sure if the Virtualbox version from the repository of my Linux distribution is already signed and works right away, but since it's not up-to-date I'm installing Virtualbox from the official ...
0
votes
0answers
32 views

Does the TPM check the addition/removal of boot-entries

I have an issue that has been puzzling me tegarding the TPM checks on my machine, and I cannot find much documentation about the checks a TPM exactly performs. The issue is the following; I have a ...
0
votes
0answers
114 views

Bypassing Secure Boot in System on Chip

To bypass a secure boot for System on Chip (SoC), some attacks target the phase of copying the bootloader from where it is stored to the main memory. Instead, a malicious code will be copied to the ...