Questions tagged [trusted-boot]
The trusted-boot tag has no usage guidance.
29
questions
0
votes
1
answer
221
views
Is there any security technology/technique beside tpm/secure boot which can verify the integrity of the bios or bootloader?
For any file on your OS you can get a md5 or sha256 value and if you suspect anything you get it again and compare. I was wondering if there is any way to do the same with the bios and bootloader and ...
- 31
1
vote
1
answer
118
views
Is it possible to allow only a certain secure USB boot media to boot an UEFI system?
I want to restrict all USB boot media from my system, except for a certain USB boot drive that I declare secure via a certain key.
Is this possible using UEFI/Secure Boot/TPM? Maybe via TPM? TPM gets ...
- 1,413
1
vote
2
answers
695
views
TPM Endorsement Key usage in secure and trusted boot
Taking into account a Root of Trust in a device using a TPM.
My understanding is that the bootloader, firmware, operating system, applications etc. are all verified on startup by validating signatures ...
- 267
-1
votes
1
answer
209
views
Booting from removeable media, evil maid, and others? [closed]
I am having a problem understanding some security techniques and was hoping someone could clarify some things. For instance, in terms of an evil maid attack, what are some solutions to preventing ...
- 589
0
votes
0
answers
604
views
Can an OS implement Trusted Boot without TPM given Secure Boot?
Since Secure Boot authenticates software, the OS only needs to check hardware. The implementation I have in mind measures hardware and compares the result of the measurement to the value in an EFI ...
- 158
0
votes
0
answers
106
views
How to execute Android verified boot during first boot after updating OS in Android?
I need to execute AVB (Android verified boot) during first boot after updating Android OS. BOARD_AVB_ENABLE = true is already present in the mk file device/hikey/common/BoardConfigCommon.mk in the ...
- 101
0
votes
0
answers
294
views
What is the difference betwen a Trusted Computing Base and a Root of Trust?
What is the difference betwen a Trusted Computing Base (TCB) and a Root of Trust (RoT)? Can both terms be used interchangeably?
A TCB is defined by the NIST as follows:
Totality of protection ...
- 127
2
votes
1
answer
119
views
Root of Trust - The general Mechanism of how RoT Authenticates higher levels of software
I've been reading many research articles about RoT - Root of Trust - for establishing a chained root of trust going up from BIOS to the Kernel.
However, most of the article go briefly on how RoT works ...
- 21
1
vote
0
answers
190
views
Does (UEFI) secure boot provide security advantages over TPM measured boot?
Given how UEFI secure boot appears later than TPM, i had assumption that it provides advantages over TPM.
As i read into each, it appears to me that the TPM measurements to each stage would provide ...
- 11
1
vote
1
answer
203
views
What are the threats addressed by a Hardware Root-of-Trust?
SoC's have begun integrating a hardware Root-of-Trust to mitigate attacks on Secure Boot. Examples include Google's OpenTitan & Intel PFR. What are the threats addressed by discrete "Secure ...
0
votes
1
answer
1k
views
What kind of "actions" can a TPM2 policy authorize?
I've been instructed to use the state of our system's TPM's PCR registers to prevent the system we're working on from booting if one of the PCR registers is different from what we expect. In service ...
- 21
1
vote
0
answers
302
views
TPM & Windows BitLocker: how does it work and is it secure?
When starting a BitLocker-encrypted machine with a TPM and Windows 10 installed, you aren't prompted to enter a decryption key. The system relies on Windows lockscreen for authentication instead. My ...
- 241
1
vote
0
answers
155
views
"Trusted memory" What does it mean?
It is often cited "to load from untrusted memory to a trusted system memory" when describing the secure boot process. I wonder, when can we consider a memory as "trusted"?
- 259
0
votes
0
answers
234
views
Bypassing Secure Boot in System on Chip
To bypass a secure boot for System on Chip (SoC), some attacks target the phase of copying the bootloader from where it is stored to the main memory. Instead, a malicious code will be copied to the ...
- 259
1
vote
1
answer
866
views
Integrity Check on power on VS. Secure boot
Can we consider the Integrity Check on power-on and the secure boot equal from security point of view?
Secure boot is about allowing only a trusted SW to boot on the processor. A chain of trust can ...
- 259
2
votes
1
answer
1k
views
BeagleBoneBlack, TPM and uBoot
I'm using BBB in my project. I need to prevent any changes to the software running on it. I've been reading about uBoot and TPM. But if I understand everything correctly, this can't be implemented ...
3
votes
2
answers
5k
views
Android boot sequence - verified boot security
After some research, my current understanding of Android's boot sequence (at least on a Qualcomm device) is as follows:
PBL --> XBL (replaces SBL) --> Aboot --> Kernel
PBL:
Primary Boot Loader (...
- 714
2
votes
1
answer
1k
views
With TPM how are the initial PCR values seeded with 'good' values?
I am trying to learn more about trusted boot / trusted platform modules and I understand about Platform Configuration Register (PCR) values being a measurement of a 'good' configuration signed by a ...
- 131
6
votes
1
answer
168
views
How does ROCA affect Windows secure boot?
I've been doing some research on the Infineon vulnerability known as ROCA over the last few days. As I understand it, the vulnerability is present when a TPM running vulnerable firmware generates an ...
9
votes
2
answers
2k
views
Android verified boot within the boot sequence
I'm interested in understanding the verified boot process in Android, yet I was unable to find insights about some properties of the process.
From what I gathered so far I get that in Android devices ...
- 201
9
votes
2
answers
2k
views
Why does Chrome tell me this certificate is valid when it can't be verified?
Update: Now Chrome rejects this website for me.
It seems the trusting is just cached somewhere?
I guess this question isn't as interesting as I thought, but it'd be nice if someone could clarify it.
...
- 2,552
2
votes
0
answers
606
views
How is hardware based chain of trust implemented in practice for secure boot?
To do secure boot we need an immutable public key baked into the ROM. This key is used to sign the boot loader or the key used to sign the boot loader. I have these questions -
Which code does this ...
- 903
3
votes
1
answer
591
views
Windows Secure Boot compromise: are fully-patched PCs vulnerable?
Are fully-patched (as of Aug. 10, 2016) Windows installs vulnerable to allowing self-signed early-boot malware to run- because of this ? If so, which versions of Windows are vulnerable.
What in ...
- 2,735
1
vote
1
answer
292
views
Deep attestation of VM's
Hypervisors like Xen have virtual TPM (vTPM) support. In cloud environments, are there any implementations where such vTPM's are being used during remote attestation in addition to the host TPM based ...
- 655
2
votes
0
answers
165
views
Level of security TPM2.0
How secure is it to seal only to PCRs 0 and PCRs 2-7 with fTPM 2.0? My device does not support Intel TXT, so I am unable to extend the chain of trust to implement DRTM, and thus cannot use PCRs 17-22....
2
votes
1
answer
673
views
Differences between Intel TXT and Linux IMA
I understand that Intel TXT provides a Dynamic Root of Trust Measurement (DRTM). Does the Linux integrity measurement architecture do logically similar things? If not, what are the differences?
- 655
14
votes
1
answer
3k
views
How are TPMs provisioned for Intel Trusted Execution Environment (TXT)?
For Intel TXT to work, the TPM must be provisioned. Intel provides some tools for doing this but many are protected by non-public login or an NDA. Many OEM platform vendors provision their boards and ...
- 608
2
votes
1
answer
615
views
Chain of Trust Extension with TPM2.0
I am looking for a way to implement a trusted boot using a firmware TPM2.0 on Arch Linux. I am using TPM2.0-TSS, and tpm2-tools, however I cannot find a way to do this with tpm2-tools, as I do not ...
1
vote
2
answers
393
views
What is the difference between Trusted boot and Kernel Patch Protection (PatchGuard)
I have understood that Trusted boot and Kernel Patch Protection (or PatchGuard) are ways that Windows uses to protect itself from rootkit infections. But I cannot find a comparison of these two ...
- 2,299