Questions tagged [trusted-boot]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
13
votes
1answer
1k views

How are TPMs provisioned for Intel Trusted Execution Environment (TXT)?

For Intel TXT to work, the TPM must be provisioned. Intel provides some tools for doing this but many are protected by non-public login or an NDA. Many OEM platform vendors provision their boards and ...
9
votes
2answers
1k views

Why does Chrome tell me this certificate is valid when it can't be verified?

Update: Now Chrome rejects this website for me. It seems the trusting is just cached somewhere? I guess this question isn't as interesting as I thought, but it'd be nice if someone could clarify it. ...
6
votes
1answer
103 views

How does ROCA affect Windows secure boot?

I've been doing some research on the Infineon vulnerability known as ROCA over the last few days. As I understand it, the vulnerability is present when a TPM running vulnerable firmware generates an ...
5
votes
0answers
304 views

Android verified boot within the boot sequence

I'm interested in understanding the verified boot process in Android, yet I was unable to find insights about some properties of the process. From what I gathered so far I get that in Android devices ...
3
votes
1answer
338 views

Windows Secure Boot compromise: are fully-patched PCs vulnerable?

Are fully-patched (as of Aug. 10, 2016) Windows installs vulnerable to allowing self-signed early-boot malware to run- because of this ? If so, which versions of Windows are vulnerable. What in ...
2
votes
1answer
395 views

Differences between Intel TXT and Linux IMA

I understand that Intel TXT provides a Dynamic Root of Trust Measurement (DRTM). Does the Linux integrity measurement architecture do logically similar things? If not, what are the differences?
2
votes
1answer
400 views

Chain of Trust Extension with TPM2.0

I am looking for a way to implement a trusted boot using a firmware TPM2.0 on Arch Linux. I am using TPM2.0-TSS, and tpm2-tools, however I cannot find a way to do this with tpm2-tools, as I do not ...
1
vote
2answers
276 views

What is the difference between Trusted boot and Kernel Patch Protection (PatchGuard)

I have understood that Trusted boot and Kernel Patch Protection (or PatchGuard) are ways that Windows uses to protect itself from rootkit infections. But I cannot find a comparison of these two ...
1
vote
1answer
170 views

Android boot sequence - verified boot security

After some research, my current understanding of Android's boot sequence (at least on a Qualcomm device) is as follows: PBL --> XBL (replaces SBL) --> Aboot --> Kernel PBL: Primary Boot Loader (...
1
vote
1answer
179 views

Deep attestation of VM's

Hypervisors like Xen have virtual TPM (vTPM) support. In cloud environments, are there any implementations where such vTPM's are being used during remote attestation in addition to the host TPM based ...
1
vote
0answers
165 views

With TPM how are the initial PCR values seeded with 'good' values?

I am trying to learn more about trusted boot / trusted platform modules and I understand about platform configuration values being a measurement of a 'good' configuration signed by a key locked from ...
1
vote
0answers
434 views

How is hardware based chain of trust implemented in practice for secure boot?

To do secure boot we need an immutable public key baked into the ROM. This key is used to sign the boot loader or the key used to sign the boot loader. I have these questions - Which code does this ...
1
vote
0answers
109 views

Level of security TPM2.0

How secure is it to seal only to PCRs 0 and PCRs 2-7 with fTPM 2.0? My device does not support Intel TXT, so I am unable to extend the chain of trust to implement DRTM, and thus cannot use PCRs 17-22....
0
votes
0answers
39 views

Should I Pursue Platform-Ownership?

the context is this introduction in an HP whitepaper. I'm inquiring about "platform-ownership" within the Secure-Boot environment. I'm looking for a simplified summary of platform-ownership. Much of ...
0
votes
0answers
47 views

Trusted Boot & Memory Safety

From what I understand on trusted boot, it is part of the SRTM (Static Root of Trust Management) system, a check/verification that is done at load time. Specifically, trusted boot measures and ...
0
votes
0answers
24 views

How to handle compromised certs in a secure boot flow?

At a high level the way secure boot functionality works is by embedding the hash of the company's root cert in ROM. Then the OS image itself is signed with a key that chains up to the root cert ...