3 ms·

> In the end, you still have to trust the root domain, which means you still need to trust system firmware and the secure boot chain. You need to trust the har

> In the end, you still have to trust the root domain, which means you still need to trust system firmware and the secure boot chain. You need to trust the hardware, and you also need the firmware. However, there is no need to trust the firmware, because the trust is provided by hardware and not by firmware. And there are certificates that allow to check if the components are trustworthy. This means that a malicious user can affect the availability of the realm, but not its integrity and the confidentiality of your data. (Assuming that hardware is trustworthy) That said there is not much information in the article I may be wrong, this is my interpretation

marcan_42 5y ago
> However, there is no need to trust the firmware, because the trust is provided by hardware and not by firmware. No, the trust is provided by the firmware. That's what runs in the root domain. Monitor firmware. It's right there in the article. The Root domain is the ultimate trust level. > And there are certificates that allow to check if the components are trustworthy. Unless there are very specific hardware-backed attestation features baked into the chips - none of which has been mentioned, and which also relies on the inability to compromise the system through hardware mechanisms, and a bug-free monitor, which is an entire difficult to solve problem - then those certificates only allow you to check that the certificate owner has, at one point, provided key material to be used by the system, not that the software running on it continues to be what was intended. You break into the monitor, you steal the attestation keys, and then you get to keep "proving" your "trustworthiness" to everyone else. This is how on-line DRM is broken every time.