4 ms·
> Even then there is no way to authenticate what you are booting. Let me introduce you to TPM, signed binaries and measured boot! However, the most secure wa
by 1996 6y ago
> Even then there is no way to authenticate what you are booting.
Let me introduce you to TPM, signed binaries and measured boot!
However, the most secure ways usually involve a flashed
kernel (coreboot) on a write protected NAND chip, of course with encrypted root, that start the boot process by dumping and sha'ing the NAND and comparing that to the whitelist.
- Foxboron 6y agoTPM usage assumes Secure Boot though. It's fairly useless if you are booting malicious files.
- 1996 6y agoWith enrolled keys and a password protected bios that refuses to add boot options to the boot menu, and refuse to boot existing options if the signature no longer matches, you can't be booting malicious files.