[Openembedded-architecture] Trusted/secure/etc layers

[Rich Persaud]

> On May 2, 2018, at 18:44, Tom Rini <trini at konsulko.com> wrote:
> 
>> On Wed, May 02, 2018 at 06:26:31AM +0200, Patrick Ohly wrote:
>> Trevor Woerner <twoerner at gmail.com> writes:
>>> Philip Tricca (for Intel) has been leading a lot of TSS work as well, he also
>>> maintains meta-measured https://github.com/flihp/meta-measured for OE recipes.
>> 
>> Note that he is very open to the idea of moving those recipes elsewhere
>> and deprecating meta-measured. The recipes themselves aren't getting
>> updated as often as they used to be, too.
> 
> Trying to break this down into small tasks, there's a number of cases
> for making use of GRUB_BUILDIN in the context of security (Intel TXT, UEFI
> secure boot, I bet the AMD equivalent of TXT).  So we have the generic
> hook we need (good!).

Intel TXT (DRTM) [1]  and UEFI secure boot (SRTM) each offer specific security benefits.  They can also be combined [2].

To achieve security benefits with DRTM, there's a bit more involved than grub. E.g. what are you measuring?  If you want to measure rootfs, it needs to be read-only.  If you OTA update and change the measurement, device fails to boot new version.  We've solved some of these issues in one configuration of OE with Xen [3].

DRTM depends on correctly implemented system BIOS.  After we started testing DRTM on endpoints in early 2010s, it took a few years and bricked devices before OEMs worked through the BIOS issues.  DRTM BIOS on servers is likely earlier in the maturity cycle.  Two devices, same CPU generation (BSP), can have different OEM BIOS quirks.  Windows 10 SystemGuard DRTM [4] may improve UEFI and OEM BIOS validation.

There's a conference [2] on these topics in May. Philip Tricca and Bruce Ashfield will be presenting, among other OE contributors.

—
Rich Persaud
http://OpenXT.org

[1] https://www.linux.com/blog/event/elce/2017/10/device-we-trust-measure-twice-compute-once-xen-linux-tpm-20-and-txt

[2] https://www.platformsecuritysummit.com/#kerrigan

[3] https://openxt.atlassian.net/wiki/spaces/DC/pages/81035265/Measured+Launch+SRTM+and+DRTM

[4] https://www.platformsecuritysummit.com/prepare/#systemguard

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openembedded.org/pipermail/openembedded-architecture/attachments/20180503/1162760f/attachment-0002.html>