5 votes

How are TPMs provisioned for Intel Trusted Execution Environment (TXT)?

The Intel TXT is a complex system designed to provide a hardware layer of security that can prevent software layer changes from resulting in increased access for attackers. Through use of stored ...
Connor Peoples's user avatar
5 votes

Why does Chrome tell me this certificate is valid when it can't be verified?

Looks like a reported bug. Someone blogged about it.
John Wu's user avatar
  • 9,301
3 votes

Why does Chrome tell me this certificate is valid when it can't be verified?

Asterisk: I don't have the answer to the question. I was able to reproduce the OP's scenario and I am just having a stab at what might be happening. I started with some basic digging into how ...
katrix's user avatar
  • 563
3 votes

Android verified boot within the boot sequence

AVB is enforced by the bootloader and dm-verity is enforced by the kernel. Both run consecutively in android boot flow. In factory: OEM constructs hashtree of /system, /vendor, product and ODM ...
defalt's user avatar
  • 6,861
3 votes
Accepted

BeagleBoneBlack, TPM and uBoot

I understand that during boot, each boot stage passes "something" to TPM That "something" is the SHA-1 hash of the component being measured. The first thing sent is the hash of ...
forest's user avatar
  • 66.7k
2 votes

Android boot sequence - verified boot security

I know this is old but I just wanted to add to the existing answer that if the OEM has not blown certain fuses you can use a different PBL. From your first link If the QFUSE fuse row labeled ...
Deoxal's user avatar
  • 121
2 votes
Accepted

Android boot sequence - verified boot security

I can't speak to Qualcomm or Android in particular, but any time that you're doing code signing, the client needs to begin its chain of trust somewhere. And an immutable, non-upgradable, non-revocable ...
Mike Ounsworth's user avatar
2 votes

With TPM how are the initial PCR values seeded with 'good' values?

What you asked is the PCR values from so-called "golden measurement" or "baseline measurement", which can be conducted by the platform manufacturer such as DELL or platform administrator like your ...
Xiao-Feng Li's user avatar
2 votes

Root of Trust - The general Mechanism of how RoT Authenticates higher levels of software

Great question! The article you link, to me, uses a lot of words to say very little (ie I find that it is lacking specific detail). Instead I will base my answer on this page: Secure Boot | Microsoft ...
Mike Ounsworth's user avatar
2 votes

What kind of "actions" can a TPM2 policy authorize?

TL;DR: you can prevent booting directly. However, not the TPM stops the boot process, but the last trusted component in your chain of trust (e.g. your bootloader). A TPM is passive, i.e. it receives ...
MemAllox's user avatar
  • 581
2 votes
Accepted

Integrity Check on power on VS. Secure boot

The advantage of Secure Boot vs your Integrity check is that Secure Boot allows updating. Secure boot verifies the bootloader's signature, so the bootloader can be updated without changing the the ...
Douglas Leeder's user avatar
2 votes

Differences between Intel TXT and Linux IMA

No, they are complementary. DRTM provides a Root of Trust on which you can build applications/use-cases such as Integrity measurement of your entire linux system (IMA). However, it is not part of it. ...
northox's user avatar
  • 1,433
2 votes

How does measured boot work using TPM

You didn't really specify the type of device in question so my answer will focus on x86_64 devices running Linux. For phone, my reference is GrapheneOS with their Auditor App. It all comes down to the ...
Rand0mMan's user avatar
  • 136
1 vote

Is it possible to allow only a certain secure USB boot media to boot an UEFI system?

It depends. Your firmware may allow you to enroll certain signing keys for secure boot, and you could sign your existing OS plus the bootable material on the flash drive, and nothing else. However, ...
bk2204's user avatar
  • 9,434
1 vote

TPM Endorsement Key usage in secure and trusted boot

TPM is generally used for two purposes: prove the system is in a trusted state and the secure storage of keys. For the first purpose, it is necessary to prove the software/firmware is talking to the ...
billc.cn's user avatar
  • 3,926
1 vote

Booting from removeable media, evil maid, and others?

You have it a bit backwards. The evil maid attack is when the evil maid brings in bootable removable media and boots your system on it and then accesses your filesystem bypassing all privilege checks. ...
user10489's user avatar
  • 2,003
1 vote

Android verified boot within the boot sequence

I know it is old question but anyways here some answers since the official documentation is lacking many important details: Documentation to AVB can be found on the Google developers site and the ...
Me7e0r's user avatar
  • 83
1 vote

How does ROCA affect Windows secure boot?

As far as I know, the vulnerable library is used by the Federal Information Processing Standard and by CC EAL5+, the same library is used in Windows 10 Secure Boot. The RSA public key is made of two ...
Soufiane Tahiri's user avatar
1 vote

Windows Secure Boot compromise: are fully-patched PCs vulnerable?

Microsoft has inadvertently released material that allows secure boot to be bypassed. What they released was not a key in the cryptographic sense, but it's actually a good metaphor to think of it as a ...
Gilles 'SO- stop being evil''s user avatar
1 vote

Deep attestation of VM's

There is a very helpful document on this from IBM that can enlighten you on your query. It is necessary to enable remote parties that have established trust in the initial environment to also ...
Overmind's user avatar
  • 8,899
1 vote

Chain of Trust Extension with TPM2.0

The tpm2-tools does not provide trusted boot by itself. It provides tools to play with the TPM. What you are looking for is really either DRTM or SRTM (Dynamic, Static Root of Trust for Measurement)....
northox's user avatar
  • 1,433
1 vote
Accepted

What is the difference between Trusted boot and Kernel Patch Protection (PatchGuard)

I'd say Kernel Patch Protection is not specifically aimed at malicious code like rootkit but rather legitimate yet poorly-designed drivers. Before such protection, some special kernel drivers, like ...
billc.cn's user avatar
  • 3,926
1 vote

What is the difference between Trusted boot and Kernel Patch Protection (PatchGuard)

Question 1: Kernel Path Protection is focused on the the protection of the Kernel, this means that device drivers cannot modify anything related with the Kernel. If Kernel Path Protection is enabled, ...
mike-stokkel's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible