Boot Requirements and Strategies for the Edge

on YouTube ↗22m

" summary

Goal is a concrete reference: implement UEFI secure boot, add a UEFI random number protocol, and use UEFI capsule updates for variable changes so runtime services are limited. Persistent keys move from a monolithic secure payload into standalone MM ported to OP-TEE with a dispatcher to support firmware TPM and nonrepudiable logs. U-Boot variables become separate from UEFI variables (decoupled U-Boot and UEFI variable stores). Prototype secure-variable backend and capsule flow aims to run by the next events.

AI-written summary · about

" chapters (12)

1. 0:00Introduction and motivation
2. 1:12Secure boot and OTA standards
3. 2:19UEFI as standard interface
4. 3:21Secure boot implementation
5. 4:29Persistent secure variables
6. 6:23Decoupling UEFI and U-Boot variables
7. 9:12Runtime services and security
8. 12:27Random number protocol
9. 13:16Capsule updates and platform specifics
10. 15:23Implementation goals and feedback
11. 20:18Entropy and hardware limitations
12. 20:51Q&A and summary

" related talks

• 27mSecuring Arm ServersMatteo Carlini · Linaro Connect Hong Kong 2018
• 38mUEFI Secure Boot in U-BootGrant Likely · Open Source Summit + Embedded Linux Conference North America 2019
• 27mSecure Boot auto enrollmentvincent dagonneau · Linux Plumbers Conference 2022
• 24mSecure boot, TEEs, different OSes and moreMarta Rybczynska · FOSDEM 2022
• 42mBecoming a tyrant: Implementing secure boot in embedded devicesIrving Tjiptowarsono · linux.conf.au 2022
• 40mWhat should I know about secure boot and TEEs?Marta Rybczynska · foss-north 2022
• 40mUEFI Setvariable at runtime -- Problems status and solutionsIlias Apalodimas · Linux Plumbers Conference 2023
• 39mTowards Measured Boot Out of the BoxMatthew Garrett · Linux Security Summit 2016