Poettering: Brave new trusted boot world [LWN.net]

Poettering: Brave new trusted boot world

Posted Oct 3, 2023 20:08 UTC (Tue) by mjg59 (subscriber, #23239)
In reply to: Poettering: Brave new trusted boot world by kreijack
Parent article: Poettering: Brave new trusted boot world

> You should remove all the keys (even the Microsoft key ) from the uefi-bios except the one that allow your shim to work, otherwise anything that was signed with (e.g.) Microsoft key may break the protection...

How? If anything is signed with a different cert chain (even if it's a shim signed with the Microsoft key, it will then measure the vendor cert before booting the second stage) then the PCR 7 measurement will be different and you won't be able to unseal the material.

> From the points above it seems to me that the PCR11 signature of an UKI file, is secure only in a strongly constrained environment, i.e. where it is possible to be sure that all 'bootloader chain' is secure.

The alternative is to seal to PCRs 0-5+11. This doesn't rely on any sort of secure boot chain but does increase fragility over firmware updates or some security-relevant configuration changes.

to post comments

Poettering: Brave new trusted boot world

Posted Oct 4, 2023 17:38 UTC (Wed) by kreijack (guest, #43513) [Link]

> > You should remove all the keys (even the Microsoft key ) from the uefi-bios except the one that allow your shim to work, otherwise anything that was signed with (e.g.) Microsoft key may break the protection...

> How? If anything is signed with a different cert chain (even if it's a shim signed with the Microsoft key, it will then measure the vendor cert before booting the second stage) then the PCR 7 measurement will be different and you won't be able to unseal the material.

Ok, I missed the fact that PCR7 measures the PK/KEK/db and *the "specific certificates used to validate each boot application"* [1].

But this means that the boot application have to be signed by a non public 'private key'; the same is true for the UKI.
Otherwise the user need to deploy a host-specific certificate to sign the uki.

> > From the points above it seems to me that the PCR11 signature of an UKI file, is secure only in a strongly constrained environment, i.e. where it is possible to be sure that all 'bootloader chain' is secure.

> The alternative is to seal to PCRs 0-5+11. This doesn't rely on any sort of secure boot chain but does increase fragility over firmware updates or some security-relevant configuration changes.

[1] from https://wiki.archlinux.org/title/Trusted_Platform_Module