lkml.org 
[lkml]   [2012]   [Oct]   [31]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [RFC] Second attempt at kernel secure boot support
On Wed, Oct 31, 2012 at 03:50:00PM +0100, Jiri Kosina wrote:

> Reading stored memory image (potentially tampered before reboot) from disk
> is basically DMA-ing arbitrary data over the whole RAM. I am currently not
> able to imagine a scenario how this could be made "secure" (without
> storing private keys to sign the hibernation image on the machine itself
> which, well, doesn't sound secure either).

shim generates a public and private key. It hands the kernel the private
key in a boot parameter and stores the public key in a boot variable. On
suspend, the kernel signs the suspend image with that private key and
discards it. On the next boot, shim generates a new key pair and hands
the new private key to the kernel along with the old public key. The
kernel verifies the suspend image before resuming it. The only way to
subvert this would be to be able to access kernel memory directly, which
means the attacker has already won.

Now someone just needs to write it.

--
Matthew Garrett | mjg59@srcf.ucam.org


\
 
 \ /
  Last update: 2012-10-31 16:21    [W:0.452 / U:0.208 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site