Improving the Secure Boot landscape: sbctl & go-uefi

Video in TIB AV-Portal: Improving the Secure Boot landscape: sbctl & go-uefi

Formal Metadata

Title
Improving the Secure Boot landscape: sbctl & go-uefi
Title of Series
Author
License
CC Attribution 2.0 Belgium:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Identifiers
Publisher
Release Date
2021
Language
English

Content Metadata

Subject Area
Abstract
Utilizing secure boot should be simple. Our current tooling is badly integrated, abstractions leaking and the code bases are not reusable. Functionality is spread between several projects and not one covers all your needs. This amounts to a confusing landscape. sbctl and go-uefi is a tool, and a low-level UEFI library, that attempts to push the secure boot landscape forward. In this talk I'll do a short introduction of secure boot and the tooling people normally use. We will look at the different use cases each of them provide and missing functionality. Then I'll do a short demonstration of sbctl and go-uefi. The goal is to try provoke some ideas how we can make secure boot more accessible for users. Currently the tooling assumes some familiarity with secure boot implementation details (signature lists, PK/KEK/db keys and so on) and that shouldn't be needed to have a fairly basic secure boot setup.
Multiplication Touchscreen Open source Internet forum Software developer Sinc function Booting
Trail Complex (psychology) Software developer Chain Process (computing) Personal digital assistant Chain Quicksort Figurate number Information security Information security Fingerprint Reading (process) Spacetime
Point (geometry) Web page Implementation Presentation of a group Installation art Electronic program guide Set (mathematics) Database Mereology Emulation CAN bus Sign (mathematics) Cryptography Kernel (computing) MiniDisc Implementation Key (cryptography) Cellular automaton Web page Smith chart Database Control flow Sign (mathematics) Wiki Maize Function (mathematics) Order (biology) Computing platform Moving average Key (cryptography) Quaternion group Quicksort Figurate number Fingerprint Library (computing) Booting
Web page Group action Key (cryptography) Demo (music) Multiplication sign Moment (mathematics) Source code Electronic mailing list Flow separation Sign (mathematics) Labour Party (Malta) Order (biology) Quicksort Library (computing) Sinc function Library (computing) Physical system Directed graph
Asynchronous Transfer Mode Key (cryptography) Computer file Multiplication sign File format Login Electronic signature Data management Pi Root Military operation Kernel (computing) Function (mathematics) Moving average Gastropod shell Block (periodic table) Information security Thermal conductivity Asynchronous Transfer Mode Booting
Trail Token ring Line (geometry) Computer-generated imagery Demo (music) File format Online help Rotation Neuroinformatik Formal language Medical imaging Core dump Configuration space Analytic continuation Information security Task (computing) God Physical system Operations research Electric generator Trail Software developer Computer file Token ring Expert system Client (computing) Bit Control flow Formal language Sign (mathematics) Data management Computer hardware Password Network topology Video game Moving average Key (cryptography) Quicksort Block (periodic table) Arithmetic progression Physical system Booting
Email Freeware Parsing Code Multiplication sign Disintegration Source code Design by contract Electronic signature Subset Neuroinformatik Hypermedia Computer configuration String (computer science) Core dump Repository (publishing) Software testing Data structure Analytic continuation Library (computing) Authentication Parsing Projective plane State of matter System call Subset Sign (mathematics) Word Kernel (computing) Personal digital assistant Software testing Quicksort Arithmetic progression Library (computing) Booting
Element (mathematics)
Element (mathematics)
the euro and walk into my percent asian banks curable use this tool in multiple but all now called current status or rather than trying to do to improve it.
why secure deceased difficult so my name is more know i go but in the name of fox forum i work as a secured in general to fumble and i've been the screen open source software developer since around two thousand and thirteen two thousand and sixteen have been contributing to auction the scientists be.
russian read been doing a secure job to buy extra work tracking security and abilities as a do or disability figure out how we can do it for be identical builds packages and i also do a lot of packaging and sort of like the goal of space and the container space care lot about supply chain security. in the us where my main interest from. secured stems from so secure with case it's says terrible but it's a shame because secure but this terrible for the wrong reasons and all of this stems from the complexity of the current cooling so if you want to write if you want to figure out how to create a beer.
but you'd figure out the apologists for magic in the open it and those that easy like if you do a new installation he sits trivial to remember those commands it's sort of self expects maze she explained three explained sponsoring. it's not really hard if you want to like figure out how we and rock n roll your own secure but the sea and up with like you begin to be key rob smyth controlling secure because i'd like to actually key secured the page and all these are fine but there are. extremely long articles they can contain a lot of implementation beatles and it's easy to make mistakes so if you are too. set up secure the youths needs think he is switching apart from key which is or fight the main thing that controls but from the exchange fees which authorizes the kuna can. sign your you're five secure balls and also on a database key which so far the which dust the signing of self do this year sort of make three key is sweet or hope no so you also to a turkey which will make its presentation that i don't know why why why do it. i forgot currently in the dirtiest wall and people based all these crimes so all these comments are virtually the same across the can to watch the key pay just because all copied from the road smith guide you see this because it's the three and three thousand six hundred fifty days to expire m q's. his and you should they all have our air star say twenty four he ate a strength. the only critic new idea. food for murray be around them you take the pump she isn't he doing a feisty neutralised with them and amuse sighing e.s.l. the the p p k needs on the cell therapy can use to sign the czech seen interest and the jackie in its assigned are there. base centralist an already at this point two mark wilson what the year feisty interest and while it's explain them the contagion order man pages but you don't really need to you should really have need to know how what works and i need to enroll the keys. what is usually done with a year for up to the worst you can also serve to use the tool your fights to double our own song more the bourse also sports in there are a sort of by side of the till this. an next park is to use kernow on that sort of were some people dislike just the five tools the slots part signing need someone that implements a p a cough executable signing and you need another set of tools to do in signing so well. what could be use as the scientists also she is just going to end by canonical and that allows you to to sign the keys know our son colonel rebuilt and hopefully it to works so that was seventeen command and two packages to two.
steps forward. a lot's i think we can do we can do a lot better. there's no really good reason why it is like this like asked to sign to also in command small so what you're fired two stars and can live better way it's also the signing because it implements the peak happy cough library which is used sunday your post.
and also action sports some undocumented key and wrong system which called s. the key sink which just moment page public since and again you're fired tools to propose providing a signing there's also the peace sign tools german team by red hat. day i don't think to do all the things you have to organise signed tools to us in the months yet another peacock library because. see i guess. people on this is obvious did not that easy to dispute lab source labour is the people here as of right or wrong or how to distribute. our the comic library for this. if you want to hug her vocation list people have been using the vieques tool but this is now the cricket and merchant of to from her from her update hunter tooling so the the orders there's a lot of like separate tools to toss lot of things not easy to get across both if you're saying this. uk the first time so my conclusion has basically been that that we can do better get a lot better actually so.
that's sort of brings me to the demo which had today which is basically.
going to do a quick. she may run so. well how we use the old b m a. secure boat from earth's with. with the colonel so what we're currently have. you know we can run status and senior and set up mode which allows us to and roll keys to do not want us here but enabled. so we're going to quickly fix that by air. by creating some keys. so this is. does all the concert a peerless previously did. and i also want to. peace now the keys to her saying so if your own stairs again will see ago that in our out of sight of most secure is still the sable so what i'm going to do is to want to simon crying all. i'm. you just. same this future n n you have a colonel so now i can. also all the stalls also have done. so the subsurface keep all the files signed so now how sunday carno and role he's so now just going to do you. worse. team again this time around to show. so what do you good manager by to show will screen. i'm moving will go she says. so we have. the car at the have signed so if we try. run this on only five just day see that its commander stairs access denied the biggest conduct the pie is not actually signed. however if we do. i'm not the a fiery specified root of ourselves. now we see that you're actually buddha linux.
let's face it though it's on you now see that we actually have more disabled securities mabel and everything is fine and dandy so that was quick to them is rationed how it.
it could be that much better so it says the studio which is secure with control or.
original roll your fire all are the four years ago which was a huge task it just generous all the cheese and and also it works but so secure birds bashes a little bit of limiting when things get complicated cost. so as the deal was also signing team management the dusty enrollment mills keeps track of what science can also used his along with saudi if i start generations you can have the interim a fuss and the colonel son together which enables people to not being able to modify. i. the signed image when you're dumb because that's still a threat if you only son colonel so there are so few missing features the city others not implement its of your taste in just a continuation fall stand firmly with have harboured tokens because most of the gods. this expense to have to do. so have a clean g.'s no password snow no one will harm tokens. it were experts if you don't encrypt your this then you don't have that much for security again i've had a lot of help from coal role in urban core are somewhat in the picture and developer. working on us busy the island it worse i use it daily of my. a computer now insists this is the eldest son kernels it's mostly like quality of life the trees left i think. just still a slight problem. even though we we we serve for regional the same goal on stuff still shell out to test the scientists to call the actual this tossed we will not ease and passion more meeting a system language so why are we still showing out that sort of what they call my fancy traffic. so easy to use your way of progress.
so go your fight is sort of my my continuation of the project. and that's basically media star of krona picking up the year fastest vacation or start reading it's so it implements loved the structures from secured from the fastest vacation moakler things well and secure but this or that i'm doing gusts of them and then call as to how call library.
that supports s.p.c. the island secure its stuff it implements much sort of hundred gold which is what's he used for you by signing the contract some the kernels will sign it. most of works those implements a subset of p.c.'s see seven which is needed or for verifying the pall sam and schering which you can stuff. so how it works is that we try to provide some pablo a.b.i. can use to be cal sector took something we can retain some fifty to me she and we can just. signed a peacock executable why back out again and his words have been my computer on this before. so that's that's a very fun the first time the worked we also do if i burbled authentication which is used to date bearable sell to sign with so you can do. string to do id we can now read some exponents or fall we can do and you see interest and the final which i knew i'd do id he says the new by suffered can write seem to listen to sign. the variable this also works so. remember most of the a five tools smaller this decide to walls by race in go to just and sure things were and anecdotes which is and get on so on all of this is very much a work in progress it's not down. i'm at all. ms thing. top of my stop lower p.r. so nothing is really stable to be just seven of code he doesn't parse a second warm structures that all in some cases so they're still age he says where are you unable to verify seen interest. will get. bad i think huge problem fixed i also want to tie into question just so we can make sure to the day the aisles stuff lecture works with your post occasion now been sort of harming about doing this with the beam test. leiberman toll was another option extol and jal core actually k two things so it's also on the country in its only because you only really care about the you far. the fall so there's such posts so does not have sex or means from comparable compatible but it works it's nice that is nothing i berated it's sort of first goals but it needs a little worse for been stable the end goal is to move. the c.d.o. away from showing out to be signed tools and much are you still you go you're fine said. so that's what my short introduction to these tools to try to figure out how can do better or both of these to all this is public call three and all the source also tried to serve a secure but have sought to try document realm things to learn while. working on this but it's that's project that that's really not well on the way it. if you're curious about this work or have questions to the most are no you can also pay me on fox for all. humphrey notice wall so.
not knowing our people are interested and so making it easier for users. thank you.
Feedback