Hey everyone,
I'm reading through the source code and found vboot. It should standing for verified boot. However I can't find any documentation(except the source code). Can anyone provide me with some explanation how to get it going or to make a little more sense of it?
As far as I understand it needs to verify the signature against a Key/CA. This key should be located within the TPM. But how should the key/CA look like? Will be a classic x509 be enough?
best regards, akendo
On Fri, Jun 29, 2018 at 8:34 AM, Akendo akendo@akendo.eu wrote:
Hey everyone,
I'm reading through the source code and found vboot. It should standing for verified boot. However I can't find any documentation(except the source code). Can anyone provide me with some explanation how to get it going or to make a little more sense of it?
As far as I understand it needs to verify the signature against a Key/CA. This key should be located within the TPM. But how should the key/CA look like? Will be a classic x509 be enough?
Hi Akendo, Here is some more background on vboot: https://www.chromium.org/chromium-os/chromiumos-design-docs/verified-boot https://www.chromium.org/chromium-os/chromiumos-design-docs/firmware-boot-an...
In this schema usually the public key is stored in a write-protected region of the firmware ROM. You can store it anywhere you want so long as you can guarantee that it can't be tampered with in an undesirable way.
-
Akendo -
David Hendricks