Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [trusted-boot]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
4 votes
1 answer
219 views

How does measured boot work using TPM

Within the measured boot process, consider a scenario where I aim to create a measurement for a specific piece of code, perhaps, for illustrative purposes, a potentially malicious operating system. so ...
ezio's user avatar
  • 141
0 votes
1 answer
298 views

Is there any security technology/technique beside tpm/secure boot which can verify the integrity of the bios or bootloader?

For any file on your OS you can get a md5 or sha256 value and if you suspect anything you get it again and compare. I was wondering if there is any way to do the same with the bios and bootloader and ...
User4857's user avatar
1 vote
1 answer
179 views

Is it possible to allow only a certain secure USB boot media to boot an UEFI system?

I want to restrict all USB boot media from my system, except for a certain USB boot drive that I declare secure via a certain key. Is this possible using UEFI/Secure Boot/TPM? Maybe via TPM? TPM gets ...
JohnnyFromBF's user avatar
  • 1,413
1 vote
2 answers
976 views

TPM Endorsement Key usage in secure and trusted boot

Taking into account a Root of Trust in a device using a TPM. My understanding is that the bootloader, firmware, operating system, applications etc. are all verified on startup by validating signatures ...
Engineer999's user avatar
-1 votes
1 answer
274 views

Booting from removeable media, evil maid, and others? [closed]

I am having a problem understanding some security techniques and was hoping someone could clarify some things. For instance, in terms of an evil maid attack, what are some solutions to preventing ...
Rideboards's user avatar
0 votes
0 answers
791 views

Can an OS implement Trusted Boot without TPM given Secure Boot?

Since Secure Boot authenticates software, the OS only needs to check hardware. The implementation I have in mind measures hardware and compares the result of the measurement to the value in an EFI ...
beroal's user avatar
  • 158
0 votes
0 answers
141 views

How to execute Android verified boot during first boot after updating OS in Android?

I need to execute AVB (Android verified boot) during first boot after updating Android OS. BOARD_AVB_ENABLE = true is already present in the mk file device/hikey/common/BoardConfigCommon.mk in the ...
Abracadabra's user avatar
0 votes
0 answers
381 views

What is the difference betwen a Trusted Computing Base and a Root of Trust?

What is the difference betwen a Trusted Computing Base (TCB) and a Root of Trust (RoT)? Can both terms be used interchangeably? A TCB is defined by the NIST as follows: Totality of protection ...
DurandA's user avatar
  • 127
2 votes
1 answer
177 views

Root of Trust - The general Mechanism of how RoT Authenticates higher levels of software

I've been reading many research articles about RoT - Root of Trust - for establishing a chained root of trust going up from BIOS to the Kernel. However, most of the article go briefly on how RoT works ...
Omar Jarkas's user avatar
1 vote
0 answers
225 views

Does (UEFI) secure boot provide security advantages over TPM measured boot?

Given how UEFI secure boot appears later than TPM, i had assumption that it provides advantages over TPM. As i read into each, it appears to me that the TPM measurements to each stage would provide ...
Feiyeung's user avatar
1 vote
1 answer
250 views

What are the threats addressed by a Hardware Root-of-Trust?

SoC's have begun integrating a hardware Root-of-Trust to mitigate attacks on Secure Boot. Examples include Google's OpenTitan & Intel PFR. What are the threats addressed by discrete "Secure ...
Indranil Banerjee's user avatar
0 votes
1 answer
1k views

What kind of "actions" can a TPM2 policy authorize?

I've been instructed to use the state of our system's TPM's PCR registers to prevent the system we're working on from booting if one of the PCR registers is different from what we expect. In service ...
user1733212's user avatar
2 votes
0 answers
348 views

TPM & Windows BitLocker: how does it work and is it secure?

When starting a BitLocker-encrypted machine with a TPM and Windows 10 installed, you aren't prompted to enter a decryption key. The system relies on Windows lockscreen for authentication instead. My ...
Manchineel's user avatar
1 vote
0 answers
183 views

"Trusted memory" What does it mean?

It is often cited "to load from untrusted memory to a trusted system memory" when describing the secure boot process. I wonder, when can we consider a memory as "trusted"?
Lavender's user avatar
  • 259
0 votes
0 answers
278 views

Bypassing Secure Boot in System on Chip

To bypass a secure boot for System on Chip (SoC), some attacks target the phase of copying the bootloader from where it is stored to the main memory. Instead, a malicious code will be copied to the ...
Lavender's user avatar
  • 259
1 vote
1 answer
1k views

Integrity Check on power on VS. Secure boot

Can we consider the Integrity Check on power-on and the secure boot equal from security point of view? Secure boot is about allowing only a trusted SW to boot on the processor. A chain of trust can ...
Lavender's user avatar
  • 259
2 votes
1 answer
2k views

BeagleBoneBlack, TPM and uBoot

I'm using BBB in my project. I need to prevent any changes to the software running on it. I've been reading about uBoot and TPM. But if I understand everything correctly, this can't be implemented ...
Jędrzej Dudkiewicz's user avatar
3 votes
2 answers
6k views

Android boot sequence - verified boot security

After some research, my current understanding of Android's boot sequence (at least on a Qualcomm device) is as follows: PBL --> XBL (replaces SBL) --> Aboot --> Kernel PBL: Primary Boot Loader (...
el_tigro's user avatar
  • 704
2 votes
1 answer
2k views

With TPM how are the initial PCR values seeded with 'good' values?

I am trying to learn more about trusted boot / trusted platform modules and I understand about Platform Configuration Register (PCR) values being a measurement of a 'good' configuration signed by a ...
decodebytes's user avatar
6 votes
1 answer
189 views

How does ROCA affect Windows secure boot?

I've been doing some research on the Infineon vulnerability known as ROCA over the last few days. As I understand it, the vulnerability is present when a TPM running vulnerable firmware generates an ...
transportpoopmodule's user avatar
9 votes
2 answers
3k views

Android verified boot within the boot sequence

I'm interested in understanding the verified boot process in Android, yet I was unable to find insights about some properties of the process. From what I gathered so far I get that in Android devices ...
DannyL's user avatar
  • 201
9 votes
2 answers
2k views

Why does Chrome tell me this certificate is valid when it can't be verified?

Update: Now Chrome rejects this website for me. It seems the trusting is just cached somewhere? I guess this question isn't as interesting as I thought, but it'd be nice if someone could clarify it. ...
user541686's user avatar
  • 2,562
2 votes
0 answers
630 views

How is hardware based chain of trust implemented in practice for secure boot?

To do secure boot we need an immutable public key baked into the ROM. This key is used to sign the boot loader or the key used to sign the boot loader. I have these questions - Which code does this ...
user220201's user avatar
3 votes
1 answer
628 views

Windows Secure Boot compromise: are fully-patched PCs vulnerable?

Are fully-patched (as of Aug. 10, 2016) Windows installs vulnerable to allowing self-signed early-boot malware to run- because of this ? If so, which versions of Windows are vulnerable. What in ...
mostlyinformed's user avatar
1 vote
1 answer
313 views

Deep attestation of VM's

Hypervisors like Xen have virtual TPM (vTPM) support. In cloud environments, are there any implementations where such vTPM's are being used during remote attestation in addition to the host TPM based ...
DaTaBomB's user avatar
  • 665
2 votes
0 answers
184 views

Level of security TPM2.0

How secure is it to seal only to PCRs 0 and PCRs 2-7 with fTPM 2.0? My device does not support Intel TXT, so I am unable to extend the chain of trust to implement DRTM, and thus cannot use PCRs 17-22....
howcanIfindnem0's user avatar
2 votes
1 answer
716 views

Differences between Intel TXT and Linux IMA

I understand that Intel TXT provides a Dynamic Root of Trust Measurement (DRTM). Does the Linux integrity measurement architecture do logically similar things? If not, what are the differences?
DaTaBomB's user avatar
  • 665
14 votes
1 answer
3k views

How are TPMs provisioned for Intel Trusted Execution Environment (TXT)?

For Intel TXT to work, the TPM must be provisioned. Intel provides some tools for doing this but many are protected by non-public login or an NDA. Many OEM platform vendors provision their boards and ...
Wilbur Whateley's user avatar
2 votes
1 answer
637 views

Chain of Trust Extension with TPM2.0

I am looking for a way to implement a trusted boot using a firmware TPM2.0 on Arch Linux. I am using TPM2.0-TSS, and tpm2-tools, however I cannot find a way to do this with tpm2-tools, as I do not ...
howcanIfindnem0's user avatar
1 vote
2 answers
433 views

What is the difference between Trusted boot and Kernel Patch Protection (PatchGuard)

I have understood that Trusted boot and Kernel Patch Protection (or PatchGuard) are ways that Windows uses to protect itself from rootkit infections. But I cannot find a comparison of these two ...
pineappleman's user avatar
  • 2,299