Questions tagged [trusted-boot]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1
vote
1answer
72 views

BeagleBoneBlack, TPM and uBoot

I'm using BBB in my project. I need to prevent any changes to the software running on it. I've been reading about uBoot and TPM. But if I understand everything correctly, this can't be implemented ...
0
votes
0answers
42 views

Should I Pursue Platform-Ownership?

the context is this introduction in an HP whitepaper. I'm inquiring about "platform-ownership" within the Secure-Boot environment. I'm looking for a simplified summary of platform-ownership. Much of ...
0
votes
0answers
47 views

Trusted Boot & Memory Safety

From what I understand on trusted boot, it is part of the SRTM (Static Root of Trust Management) system, a check/verification that is done at load time. Specifically, trusted boot measures and ...
0
votes
0answers
27 views

How to handle compromised certs in a secure boot flow?

At a high level the way secure boot functionality works is by embedding the hash of the company's root cert in ROM. Then the OS image itself is signed with a key that chains up to the root cert ...
1
vote
2answers
355 views

Android boot sequence - verified boot security

After some research, my current understanding of Android's boot sequence (at least on a Qualcomm device) is as follows: PBL --> XBL (replaces SBL) --> Aboot --> Kernel PBL: Primary Boot Loader (...
1
vote
0answers
179 views

With TPM how are the initial PCR values seeded with 'good' values?

I am trying to learn more about trusted boot / trusted platform modules and I understand about platform configuration values being a measurement of a 'good' configuration signed by a key locked from ...
6
votes
1answer
103 views

How does ROCA affect Windows secure boot?

I've been doing some research on the Infineon vulnerability known as ROCA over the last few days. As I understand it, the vulnerability is present when a TPM running vulnerable firmware generates an ...
6
votes
0answers
316 views

Android verified boot within the boot sequence

I'm interested in understanding the verified boot process in Android, yet I was unable to find insights about some properties of the process. From what I gathered so far I get that in Android devices ...
9
votes
2answers
1k views

Why does Chrome tell me this certificate is valid when it can't be verified?

Update: Now Chrome rejects this website for me. It seems the trusting is just cached somewhere? I guess this question isn't as interesting as I thought, but it'd be nice if someone could clarify it. ...
1
vote
0answers
445 views

How is hardware based chain of trust implemented in practice for secure boot?

To do secure boot we need an immutable public key baked into the ROM. This key is used to sign the boot loader or the key used to sign the boot loader. I have these questions - Which code does this ...
3
votes
1answer
349 views

Windows Secure Boot compromise: are fully-patched PCs vulnerable?

Are fully-patched (as of Aug. 10, 2016) Windows installs vulnerable to allowing self-signed early-boot malware to run- because of this ? If so, which versions of Windows are vulnerable. What in ...
1
vote
1answer
182 views

Deep attestation of VM's

Hypervisors like Xen have virtual TPM (vTPM) support. In cloud environments, are there any implementations where such vTPM's are being used during remote attestation in addition to the host TPM based ...
1
vote
0answers
109 views

Level of security TPM2.0

How secure is it to seal only to PCRs 0 and PCRs 2-7 with fTPM 2.0? My device does not support Intel TXT, so I am unable to extend the chain of trust to implement DRTM, and thus cannot use PCRs 17-22....
2
votes
1answer
424 views

Differences between Intel TXT and Linux IMA

I understand that Intel TXT provides a Dynamic Root of Trust Measurement (DRTM). Does the Linux integrity measurement architecture do logically similar things? If not, what are the differences?
13
votes
1answer
1k views

How are TPMs provisioned for Intel Trusted Execution Environment (TXT)?

For Intel TXT to work, the TPM must be provisioned. Intel provides some tools for doing this but many are protected by non-public login or an NDA. Many OEM platform vendors provision their boards and ...
2
votes
1answer
405 views

Chain of Trust Extension with TPM2.0

I am looking for a way to implement a trusted boot using a firmware TPM2.0 on Arch Linux. I am using TPM2.0-TSS, and tpm2-tools, however I cannot find a way to do this with tpm2-tools, as I do not ...
1
vote
2answers
279 views

What is the difference between Trusted boot and Kernel Patch Protection (PatchGuard)

I have understood that Trusted boot and Kernel Patch Protection (or PatchGuard) are ways that Windows uses to protect itself from rootkit infections. But I cannot find a comparison of these two ...