[coreboot] Bootguard signing keys

[Trammell Hudson]

On Thu, May 11, 2017 at 9:56 AM, Trammell Hudson <hudson at trmm.net> wrote:
> Unlike the few startup ACM images that I've looked at have the same
> public key for their signature, despite being on very different
> CPU models and from different IBV.

On Thu, May 11, 2017 at 10:30:48AM -0500, Allen Krell wrote:
> Boot Guard public/private key pair - Fused by OEM (e.g., Dell, HP, Lenovo),
> checked by BIOS_ACM.  Only checks Initial Boot Block (IBB) of legacy BIOS
> region of flash.  IBB is responsible for extending policy from there.

As an update to this, I have found a different key in the bootguard
startup ACM for a Lenovo X1 Carbon 4th gen:

00000080: c71ac1e2 a457e7fc aa585572 afe2baab  .....W...XUr....
00000090: fcfc17ba fbc5eed9 71e12883 a268f7ea  ........q.(..h..
000000a0: 6e2c9738 f493d7f5 97144b1a f3f18715  n,.8......K.....
000000b0: 6839783c 503392c9 2088f89c 75bdbc43  h9x<P3.. ...u..C
000000c0: 0e9ba63d e6890cac 5f221779 09d7c2cf  ...=...._".y....
000000d0: cda313f0 c7e29993 2558b740 3bd1d2df  ........%X.@;...
000000e0: b4874f4f c7dce345 24d89640 4b64fa1e  ..OO...E$.. at Kd..
000000f0: 88af6349 439827f1 39243f4b d63ae297  ..cIC.'.9$?K.:..
00000100: e2353a58 37f0ed05 701f057e 39baf3bd  .5:X7...p..~9...
00000110: 8007f1a1 ad52bae4 0964465e 1d04304b  .....R...dF^..0K
00000120: 63221dc2 fb5fd2a6 2d2ae7db 2fd47f62  c"..._..-*../..b
00000130: c993f490 f5c7f43e abc6b45d b20ecc69  .......>...]...i
00000140: 863550d4 8bb390fd 5ebf45af c3a7af05  .5P.....^.E.....
00000150: 13961217 32caf132 8f79cbbd 0c96fcee  ....2..2.y......
00000160: 819cdeb2 e0e5b1e8 9a3b3bb7 9d7167dd  .........;;..qg.
00000170: ef31f663 95956490 5edd6a7f a7f75aee  .1.c..d.^.j...Z.
00000180: 11000000

The Dell r630 and Lenovo T550 use the same key, however:

00000080: 83078196 86ad3389 c5da1fc8 639e24e2  ......3.....c.$.
00000090: 55563072 6eb5c30b 8b7da228 5f4bcfc6  UV0rn....}.(_K..
000000a0: 278092a1 9c9bc285 23181522 8291dbf0  '.......#.."....
000000b0: 9d61f68e 2a5d8670 50cc2ff7 537e6859  .a..*].pP./.S~hY
000000c0: 0eedd676 9d4c7906 bb52ec3c edbe9f03  ...v.Ly..R.<....
000000d0: eecac913 03c46372 006f2cd6 8ba70379  ......cr.o,....y
000000e0: 4f43a334 40a0ec04 4928309e 12400496  OC.4 at ...I(0.. at ..
000000f0: ec92e7e0 f8bd1afc 959b848f 52a31035  ............R..5
00000100: ef0d2939 b84b75ea fd016c2a 6b308a76  ..)9.Ku...l*k0.v
00000110: ce14b9ba f026c8a9 9bb75c4f 8f009963  .....&....\O...c
00000120: 26fd2b7e 12de4207 b647ee54 cddc228e  &.+~..B..G.T..".
00000130: 0b58e6e2 0a0caa2f d88c8d93 0d300e0a  .X...../.....0..
00000140: 28300048 0cac01da 8255c85b 802b2f58  (0.H.....U.[.+/X
00000150: f407848e 49c222ad 33b9d0c0 5dec674b  ....I.".3...].gK
00000160: db6f9150 cc55a5f2 0174858f c285a7ec  .o.P.U...t......
00000170: 4e40aabf 28eda44b 7faaba20 f33aa8d3  N at ..(..K... .:..
00000180: 11000000

-- 
Trammell