Measured Boot Support Is Heading To Coreboot
Written by Michael Larabel in Coreboot on 26 February 2019 at 03:06 AM EST. 19 Comments
COREBOOT --
Developers have been working on TPM-backed measured boot support with Coreboot. The patches are pending for upstream Coreboot to be able to offer this trusted boot integration.

Coreboot/LinuxBoot developer Philipp "_zaolin_" Deppenwiese has been working on the measured boot support for Coreboot's vboot (verified boot) component to enhance the verification/trust steps around the boot process; Vboot is most notably used by Google for verification purposes on Chromebooks.


Deppenwiese sent out the patches adding the measured boot mode to Coreboot's vboot, TCPA fixes, and other bits.

Measured boot is somewhat similar to Secure Boot and ends up exposing a set of hashes (or the "measurements" of the chain of objects encountered in the boot process) accessible to the operating system that can be used to verify the boot process. Measured boot comes down to the recording/handling of these hashes and doesn't halt or otherwise inhibit usage of the system on any conditions, unlike UEFI Secure Boot if hitting non-signed code, and is also rather open about the measurements. Once booted, the operating system or other component can then compare the measured boot hashes/values against the "golden values" stored securely elsewhere for determining if the system is in a trustworthy state. With this measured boot implementation for Coreboot vboot, the boot measurements/hashes can be obtained from the CBMEM buffer and kernel drivers running on the system reading the Coreboot tables.

Some additional details on this measured boot implementation can be found via the documentation.
Related News
About The Author
Author picture

Michael Larabel is the principal author of Phoronix.com and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 20,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and OpenBenchmarking.org automated benchmarking software. He can be followed via Twitter or contacted via MichaelLarabel.com.

Popular News This Week