Demystify Intel Security Technologies in the Firmware
summary
Open-source tooling called Converged Security Suite parses FIT/KM/BPM from firmware images, generates and signs CBnT manifests, and offers provisioning plus runtime testing (including a PCR0 diagnostic); it’s written in Go and uses the fianno firmware parser. The repo implements about 75 TXT tests, can build with go build, and runs on Linux; demos show extraction and signing work, while some tests fail on machines without a TPM and Intel PFR support remains work in progress.
AI-written summary · about
chapters (9)
- 0:00Demystify Intel Security Technologies in the Firmware
- 7:26Intro to Intel Converged Security
- 14:39Contains public key hashes for multiple security technologies - Signature protected and verified through Intel ME e-fuses - Binary data format
- 18:47Highly involved in the platform Security technologies - Contains data partition with platform configuration - E-fuses contain Key Manifest public key hash
- 25:05Intel Boot Guard and Trusted Execution Technology
- 26:43Trusted Execution Environment - Runtime measurements
- 28:13Important parts playing a role - Intel Management Engine - Firmware Security Header (BPM) - Initial Boot Block (BB)
- 36:50Converged Security Suite
- 45:10CSS Demonstration
related talks
26mKeynote: Trusted Firmware – Build Security Collaboratively
53mBehind the Scenes of Intel Security and Manageability Engine
33mSecuring TPM Secrets with TXT and Kernel Signatures
51mFirmware Cartography: Charting the Course for Modern Server Compromise
51mApplications of TPM 2.0
28mSecure bootloader for Confidential Computing
46mVerifiable End To End Secure OCI Native Machines
44mCome Join the CAFSA - Continuous Automated Firmware Security Analysis