Secure Boot

Reading List

• uBoot
  • http://www.denx-cs.de/doku/?q=m28verifiedboot
  • https://github.com/ckuethe/uboot-denx/tree/master/doc/uImage.FIT
  • https://github.com/ckuethe/uboot-denx/blob/master/doc/README.mxc_hab
  • https://github.com/ckuethe/uboot-denx/blob/master/doc/README.odroid
  • U-Boot_verified_RSA_boot_flow_on_arm_target.pdf
  • http://lwn.net/Articles/571031/
  • http://events.linuxfoundation.org/sites/events/files/slides/elce-2014.pdf
• i.MX HAB
  • https://community.freescale.com/docs/DOC-96451
  • https://community.freescale.com/docs/DOC-96409
  • https://community.freescale.com/thread/264827
  • http://boundarydevices.com/secure-boot-on-i-mx6-nitrogen6x-boards/
  • http://cache.freescale.com/files/32bit/doc/app_note/AN4581.pdf
  • http://bunniefoo.com/novena/IMX6DQ6SDLSRM_security.pdf
  • http://www.edlangley.co.uk/blog/2014/06/rescuing-bricked-secure-mode-i.mx6/
  • 0328-ENGR00217417-MX6-Provide-Secure-Boot-releated-config.patch
  • 0376-ENGR00000000-secure-boot-add-support-for-V2012-Secur.patch
• dm-verity
  • http://lwn.net/Articles/459420/
  • https://code.google.com/p/cryptsetup/wiki/DMVerity
  • https://www.kernel.org/doc/Documentation/device-mapper/verity.txt
  • http://nelenkov.blogspot.com/2014/05/using-kitkat-verified-boot.html?m=1
• Linux Binary Signing
  • http://www.phoronix.com/scan.php?page=news_item&px=MTI3NTY
  • http://lwn.net/Articles/532778/
  • http://www.jukie.net/~bart/elfpgp/
  • http://blog.codenoise.com/signelf-digitally-signing-elf-binaries

Ideas

• get a working system with CONFIG_FIT_SIGNATURE in uboot. make sandbox_config
• do some stuff to make and test a signed FIT. See vboot_test.sh
• can QEMU emulate high assurance boot? No.
• how to boot a disk image through uboot? qemu -sd sd.img -kernel u-boot.elf ...
• can uboot load a verified initrd, embedded in the FIT? ???
• how to verify disk integrity? dm-verity
• how to sign userland? signelf
• how to execute only signed userland? ???