Dynamic Key Managed PowerPC Guest Secure Boot

on YouTube ↗45m

" summary

Power secure boot for Power LPARs moves from static keys to a dynamic scheme that stores authenticated variables in a new Platform KeyStore (plpks) and submits updates via a user-space secfar tool over a sysfs interface. Boot components use appended PKCS7 signatures (ELF note) and DB/DBX/PK variables plus SBAT generation blocking; kernel and grub patches land in mainline (PKS/runtime pieces already upstream) and the demo shows grub and kernel validate and boot successfully with the new key updates.

AI-written summary · about

" chapters (15)

1. 0:00Introduction
2. 1:02Talk objectives
3. 2:27PowerPC secure boot evolution
4. 3:51Dynamic Key Management
5. 7:55Current implementation
6. 10:25Authenticated variables
7. 13:17Verification process
8. 16:11Key management tool
9. 20:25Demo: Creating variables
10. 23:39Demo: Updating variables
11. 26:39Demo: Secure boot verification
12. 28:46Roadmap
13. 33:46Future work
14. 38:42Architecture decisions
15. 39:47Q&A

" related talks

• 33mOpenPOWER: Host OS (Linux Kernel) Secure Boot Key ManagementNayna Jain · Linux Security Summit Europe 2019
• 27mPowerVM Platform Keystore - Securing Linux Credentials LocallyNayna Jain · Linux Security Summit North America 2022
• 20mExtending OpenPOWER Boot Security to GuestsGeorge Wilson · Linux Security Summit North America 2018
• 21mReconcilable Differences: Booting Linux on IBM PowerVM LPARsGeorge Wilson · Linux Plumbers Conference 2025
• 27mSecure Boot auto enrollmentvincent dagonneau · Linux Plumbers Conference 2022
• 30mKernel Hardening With Protection KeysKevin Brodsky · Linux Security Summit Europe 2025
• 41mUsing the TPM NVRAM to Protect Secure Boot Keys in POWER9 OpenPOWER SystemsClaudio de Carvalho · Linux Security Summit North America 2018
• 45mUsing Secure Boot for the powers of goodMatthew Garrett · Open Source Bridge 2013