Secure bootloader for Confidential Computing
summary
Detailed chain-of-trust and attestation mechanics for Intel TDX: virtual firmware (OVMF or TD shim) records measurements into dedicated registers and emits a CC event log per EFI CC measurement protocol (UEFI 2.10 / ACPI 6.5); a quoting enclave verifies TD report MACs, signs a TD quote, and verifier reproduces measurements from the event log. Presents an open-source tool and GitHub MVP that implements the TD report MR_TD and RTMR layout, pre-boot vs runtime disk-decryption flows, and host-side code-signing/key service integration.
AI-written summary · about
chapters (5)
- 0:00Introduction to secure bootloader
- 1:26Measurement and trust chain setup
- 7:30Disk encryption solutions
- 15:22TD Shim MVP stack
- 16:50Q&A session
related talks
26mVirtual TPM based attestation for Intel Trust Domain Extensions
30mDevice Attestation in Hardware TEE based Confidential Computing
35mChains of trust in Confidential Computing
36mEverybody is talking about Confidential Computing - the minimum Devs should know
37mIt's All About Trust: Why Confidential Computing Matters
31mIntel Trust Domain Extensions
47mThe Rise of Confidential Computing, What It Is and What it Means to You
39mFormal specification of attestation mechanisms in Confidential Computing