Date: Fri, 4 Oct 2019 20:49:39 -0500 From: "Clay Daniels Jr." <clay.daniels.jr@gmail.com> To: grarpamp <grarpamp@gmail.com>, "tomek@cedro.info" <tomek@cedro.info> Cc: "freebsd-current@freebsd.org" <freebsd-current@freebsd.org> Subject: Re: AMD Secure Encrypted Virtualization - FreeBSD Status? Message-ID: <CAGLDxTUfF0k043W=rneJX%2BtnwxKxiNawBWtF0P7a8GVs2A4cUA@mail.gmail.com> In-Reply-To: <CAD2Ti28fDwCyn2Xe%2BruKKjcRNPoXP20Yq_QXMd88B5YYxtzF_w@mail.gmail.com> References: <CAD2Ti2-2TWZEcCdyg1seHHdWRVSC9v_kuMe4f-ERo1LNdJAnmw@mail.gmail.com> <CAFYkXj=f0NEQ%2B=WQ_y8_RZtOc3-%2BHkoBreAgRM669R6s4cWSmQ@mail.gmail.com> <CAGLDxTVrN6m9VLppjv68RpnR2pAxMoPQLD0we2R6mjqcmhO8Ew@mail.gmail.com> <CAFYkXjm36_5hTVu8xCdLdmXY_Sdte3zcL069BQfZvFVwkfhK8w@mail.gmail.com> <CAD2Ti28fDwCyn2Xe%2BruKKjcRNPoXP20Yq_QXMd88B5YYxtzF_w@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Grarpamp,Tomasz, and all: Thanks for all the reference documents. I looked through them, and did some more research myself: Creating Secure Boot Keys --- 0. https://wiki.freebsd.org/SecureBoot A work in progress. --- 1. http://www.rodsbooks.com/efi-bootloaders/controlling-sb.html Need: openssl - pkg on freebsd efitools - not found freebsd, source available elswhere Note that efitools is dependent upon sbsigntool (aka sbsigntools), so you may need to install it, too. sbsigntool - not found freebsd, source available elswhere --- 2. https://www.linuxjournal.com/content/take-control-your-pc-uefi-secure-boot Similar tools to Rod's, added osslsigncode as possible substitute for sbsigntool --- My situation in life does not really seem to demand secure boot as I can always wipe the drive and rebuild. However it was pointed out that malware can continue to hide in the bios cmos nvram, so there is really no hiding and yes, we do need to consider shaping up. I am a big fan of Rod Smith ( http://www.rodsbooks.com/ ) and use his rEFInd boot loader on both my machines. It was a little trouble to set up the first time, but well worth the effort. I suspect that creating secure boot keys is a bit more complicated, but I'm going to look into it deeper. Any help & suggestions would be appreciated. My trusty old 2014 HP Pavilion has it's HP vendor platform keys, but they are not enabled. I have it in CSM mode, not UEFI mode, hence no secure boot as uefi must be enabled for secure boot. My new Ryzen 7 3700X & MSI X570 motherboard has UEFI boot set, but secure boot is not enabled. I have not even "enrolled" the vendor keys yet. So I have a lab setup to play with two machines, old & new, and the time & patience to play with this. I do welcome any suggestions and help Clay On Thu, Oct 3, 2019 at 7:01 PM grarpamp <grarpamp@gmail.com> wrote: > >> Just whose secure keys do you suggest? I go to a lot of trouble to > disable > >> secure boot so I can load any operating system I want. > > Some motherboards have BIOS that allows you to both > - Upload your own keys > - Delete all the spooky Microsoft keys > > Read the UEFI Secure Boot specification document. > Then paste all the key management specs into a ticket > with your motherboard vendor and get on them to publish > a BIOS release that has proper key management functions. > > Some BIOS makers have this as selectable options in their > BIOS reference build routines... ie: the motherboard maker doesn't > have to write any code, they just point and click, and the option > appears in a BIOS release for mobo end user customers. > > Sometimes you have to bug and escalate the mobo makers > and threaten to walk your next purchase to another mobo maker > to get them to cut and post the new BIOS release. > > https://www.uefi.org/ > https://uefi.org/learning_center/papers > https://uefi.org/specsandtesttools > https://uefi.org/sites/default/files/resources/UEFI_Spec_2_8_final.pdf > > > https://uefi.org/sites/default/files/resources/UEFI_Secure_Boot_in_Modern_Computer_Security_Solutions_2019.pdf > > https://uefi.org/sites/default/files/resources/UEFI%20Forum%20White%20Paper%20-%20Chain%20of%20Trust%20Introduction_2019.pdf > > > > The goal would be not to disable secure boot and have FreeBSD running > > with a secured bootloader :-) > > > > At the moment we have insecure boot + insecure kernel + possible > > encrypted data partition.. > > > would be really nice also to get UEFI BOOT compatible with SECURE BOOT > :-) > > Yes. > _______________________________________________ > freebsd-current@freebsd.org mailing list > https://lists.freebsd.org/mailman/listinfo/freebsd-current > To unsubscribe, send any mail to "freebsd-current-unsubscribe@freebsd.org" >
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAGLDxTUfF0k043W=rneJX%2BtnwxKxiNawBWtF0P7a8GVs2A4cUA>