Towards Measured Boot Out of the Box
summary
CoreOS adds practical measured boot: UEFI + TPM2 support in the bootloader, PCR-based measurement with log replay verification, and a working demo that seals a TOTP seed in the TPM and displays a QR/6-digit check so a user can verify boots. Code exists and deploys to servers but is not yet upstream; problems remain: lack of vendor known-good firmware values, nonreproducible initramfs builds, no automated reseal on updates, and TXT is incompatible with modern UEFI+TPM2 workflows.
AI-written summary · about
chapters (23)
- 0:00Intro
- 0:28Security of the boot chain is vital
- 1:16UEFI Secure Boot
- 3:04No way to prove verification happened
- 4:05Compromised servers
- 6:12Modified laptops
- 6:41Can't protect against hardware attacks
- 7:16Trusted Platform Module
- 7:50Small chip
- 8:30Platform Configuration Registers
- 14:02Trusted GRUB
- 17:32Traditional approach
- 19:04Unimportant configuration changes alter values
- 19:51Use the logfile
- 21:04Log entry contains description of binary and hash of binary
- 22:04Log entry contains text and hash of text
- 22:40Policy describes regular expressions
- 23:12Coreos builds policy automatically on OS release
- 25:46Use UEFI variables
- 28:21Disk encryption keys
- 30:56No secure boot support
- 31:46Incompatible with runtime UEFI
- 32:21Ship bootloader support Ship known-good measurements Integration with firmware updates Deterministic initramfs generation
related talks
51mSecuring Embedded Linux Systems with TPM 2.0
51mApplications of TPM 2.0
32mChallenges and Status of Enabling TrenchBoot in Xen Hypervisor
39mTPM Is No Silver Bullet: Pitfalls in Embedded Device Security
32mWhat's new in systemd
22mBoot Requirements and Strategies for the Edge
01h 18mSystemd & TPMs
25mTPM 2.0 Attestable Firmware: Recovering Trust After Firmware Flaws