On Thu, May 11, 2017 at 9:56 AM, Trammell Hudson hudson@trmm.net wrote:
Unlike the few startup ACM images that I've looked at have the same public key for their signature, despite being on very different CPU models and from different IBV.
On Thu, May 11, 2017 at 10:30:48AM -0500, Allen Krell wrote:
Boot Guard public/private key pair - Fused by OEM (e.g., Dell, HP, Lenovo), checked by BIOS_ACM. Only checks Initial Boot Block (IBB) of legacy BIOS region of flash. IBB is responsible for extending policy from there.
As an update to this, I have found a different key in the bootguard startup ACM for a Lenovo X1 Carbon 4th gen:
00000080: c71ac1e2 a457e7fc aa585572 afe2baab .....W...XUr.... 00000090: fcfc17ba fbc5eed9 71e12883 a268f7ea ........q.(..h.. 000000a0: 6e2c9738 f493d7f5 97144b1a f3f18715 n,.8......K..... 000000b0: 6839783c 503392c9 2088f89c 75bdbc43 h9x<P3.. ...u..C 000000c0: 0e9ba63d e6890cac 5f221779 09d7c2cf ...=...._".y.... 000000d0: cda313f0 c7e29993 2558b740 3bd1d2df ........%X.@;... 000000e0: b4874f4f c7dce345 24d89640 4b64fa1e ..OO...E$..@Kd.. 000000f0: 88af6349 439827f1 39243f4b d63ae297 ..cIC.'.9$?K.:.. 00000100: e2353a58 37f0ed05 701f057e 39baf3bd .5:X7...p..~9... 00000110: 8007f1a1 ad52bae4 0964465e 1d04304b .....R...dF^..0K 00000120: 63221dc2 fb5fd2a6 2d2ae7db 2fd47f62 c"..._..-*../..b 00000130: c993f490 f5c7f43e abc6b45d b20ecc69 .......>...]...i 00000140: 863550d4 8bb390fd 5ebf45af c3a7af05 .5P.....^.E..... 00000150: 13961217 32caf132 8f79cbbd 0c96fcee ....2..2.y...... 00000160: 819cdeb2 e0e5b1e8 9a3b3bb7 9d7167dd .........;;..qg. 00000170: ef31f663 95956490 5edd6a7f a7f75aee .1.c..d.^.j...Z. 00000180: 11000000
The Dell r630 and Lenovo T550 use the same key, however:
00000080: 83078196 86ad3389 c5da1fc8 639e24e2 ......3.....c.$. 00000090: 55563072 6eb5c30b 8b7da228 5f4bcfc6 UV0rn....}.(_K.. 000000a0: 278092a1 9c9bc285 23181522 8291dbf0 '.......#..".... 000000b0: 9d61f68e 2a5d8670 50cc2ff7 537e6859 .a..*].pP./.S~hY 000000c0: 0eedd676 9d4c7906 bb52ec3c edbe9f03 ...v.Ly..R.<.... 000000d0: eecac913 03c46372 006f2cd6 8ba70379 ......cr.o,....y 000000e0: 4f43a334 40a0ec04 4928309e 12400496 OC.4@...I(0..@.. 000000f0: ec92e7e0 f8bd1afc 959b848f 52a31035 ............R..5 00000100: ef0d2939 b84b75ea fd016c2a 6b308a76 ..)9.Ku...l*k0.v 00000110: ce14b9ba f026c8a9 9bb75c4f 8f009963 .....&....\O...c 00000120: 26fd2b7e 12de4207 b647ee54 cddc228e &.+~..B..G.T..". 00000130: 0b58e6e2 0a0caa2f d88c8d93 0d300e0a .X...../.....0.. 00000140: 28300048 0cac01da 8255c85b 802b2f58 (0.H.....U.[.+/X 00000150: f407848e 49c222ad 33b9d0c0 5dec674b ....I.".3...].gK 00000160: db6f9150 cc55a5f2 0174858f c285a7ec .o.P.U...t...... 00000170: 4e40aabf 28eda44b 7faaba20 f33aa8d3 N@..(..K... .:.. 00000180: 11000000