OpenPOWER: Host OS (Linux Kernel) Secure Boot Key Management
summary
OpenPOWER implements a pluggable host-OS secure-boot key manager that stores signing material in a TPM + OPAL keystore with two persistent banks and an update bank, requires a reboot to apply signed updates, and verifies updates using EFI Variable Authentication 2 (PKCS7-style) and EFI Signature List (ESL) containers. It exposes keys to the kernel via a sisyphus kernel interface and loads DB/DBX into the platform and blacklist keyrings for kexec/IMA appraisal. PK deletion or ownership recovery requires physical presence; signature verification work is upstream and uses a trimmed mbedTLS PKCS7 helper.
AI-written summary · about
chapters (21)
- 0:00Intro
- 0:45Acknowledgments
- 1:51Open POWER Secure Boot
- 3:18What is Key Management
- 3:46Existing Mechanisms for Secure Boot Key Management
- 5:57Key Management Layers
- 6:43Key Management Intemals
- 8:59Open Source Key Tools
- 10:44Authorities over Key Management and Usage
- 13:20Flexible Key Authorities
- 19:29Backend Internals (Eric Richter)
- 20:03Key Updates Processing
- 21:41Protection of the Key Database - Storage & TSS
- 24:16Kemel Verification
- 25:55Kernel Verification Flow
- 26:56Key Destruction
- 27:57Key Rotation
- 28:11Error Logs and Recovery
- 29:20OpenPOWER Key Management - Key Takeaways
- 31:02Revisiting Mechanisms for Secure Boot Key Management
- 32:21References
related talks
45mDynamic Key Managed PowerPC Guest Secure Boot
20mExtending OpenPOWER Boot Security to Guests
35mUsing Linux as a Secure Boot Loader for OpenPOWER Servers
41mUsing the TPM NVRAM to Protect Secure Boot Keys in POWER9 OpenPOWER Systems
27mPowerVM Platform Keystore - Securing Linux Credentials Locally
39mSecuring firmware: Secure and Trusted boot in OpenBMC
45mUsing Secure Boot for the powers of good
27mSecure Boot auto enrollment