6 ms·
UEFI Secure Boot on the Raspberry Pi
- MPSimmons 4y agoWhat does the Pi use as a secure enclave?
- gjsman-1000 4y agoThe Pi does not have a Secure Enclave for secrets; as far as I know. However, it does have OTP (One Time Programmable Memory) also known as e-fuses, which if you burn a key into, it will check whatever it boots matches that key. No Secure Enclave is necessary for that functionality.
- MPSimmons 4y agoOh nice, I didn't know about the OTP memory. That's useful. Thanks!
- monocasa 4y agoI'm probably just missing it, but I'm not seeing a step where the firmware itself is locking itself to an individual RPi, which would mean you can simply change out the USB drive itself and boot whatever you want. Does it do that transparently, maybe when the keys are enrolled?
- ilyt 4y agoThe idea is that then bootloader verifies the rest; then your kernel would need to verify everything it runs.
- monocasa 4y agoSure, but also normally you aren't manually installing the relevant firmware. There's different semantics when the 'firmware' lives on the same block device as your root filesystem.
- dividuum 4y agoThe Pi4 has true hardware support for secure boot. If set up correctly, you won't be able to boot anything not properly signed. An incomplete overview of how this works is: * Instead of having all boot related files (start4.elf, kernel.img, ...) on the first partition of the SD card, you instead have a single boot.img FAT image containing those files instead. * You sign that file with your own RSA 2048 key and place a boot.sig containing the signature next to the boot.img file. * You flash the Pi4 EEPROM and include your public key and some additional EEPROM settings. * You instruct the EEPROM to burn the hash of your public key into the Pi's OTP memory. Once that's done, the key cannot be changed and the Pi will not boot into anything not signed with your key. * Optionally you can also place keys for disk encryption into the OTP memory and use that to encrypt everything except the boot files. That way it should be pretty hard to access them as you cannot run a rogue OS to read the OTP memory due to secure boot. References: * https://github.com/raspberrypi/usbboot/blob/master/secure-boot-example/README.md https://github.com/raspberrypi/usbboot/blob/master/secure-bo... * https://github.com/raspberrypi/usbboot/blob/master/docs/secure-boot-train-of-trust.pdf https://github.com/raspberrypi/usbboot/blob/master/docs/secu... (441KB PDF)
- synergy20 4y agothe eeprom is upgradable, someone can just reflash the eeprom and instruct it to ignore the public key in the OTP, thus render the whole crypto chain useless?
- temptemptemp111 4y ago[dead]
- dividuum 4y agoI think that's what program_pubkey[1] is preventing. While you could still flash other EEPROMs, their then mandatory public key would not match the hash written to the OTP. [1] https://www.raspberrypi.com/documentation/computers/raspberry-pi.html#program_pubkey https://www.raspberrypi.com/documentation/computers/raspberr...
- section_me 4y ago
- amelius 4y agoWhat is the end-goal here? Vendor locking?
- section_me 4y agoOr the mitigation of someone running unsigned code on your product using an embedded pi. Stop some ways supply chain attacks can happen. Probably some other use cases I've not considered too.
- justeleblanc 4y agoMake sure that someone doesn't tamper with your device. No, it's not infallible. Yes, it's better than nothing.
- deckard1 4y agoIf I have access to the physical device and the SD card/USB drive in order to pull off an attack that secure boot prevents, then why wouldn't I just take the whole damn device and swap it with my own? Presumably the network/gpio/etc. are the important part here and not the Pi.
- gjsman-1000 4y agoWell, if you have physical access, you can always do basically anything. I'm sure you can easily mess up a lot of industrial equipment with your bare hands. However, let's say that the said industrial equipment is stored in a security box, with tamper-resistant screws, and you are on camera. It's a lot harder to tamper with then, compared to just plugging in a flash drive and rebooting the Pi into USB boot; at least in theory. Ditto for helping to prevent persistent remote attacks.
- captn3m0 4y agoYou'd presumably be using the secure boot to authenticate the device, on the network and elsewhere.
- deleted 4y ago[deleted]
- deleted 4y ago[deleted]
- kylehotchkiss 4y agoWhen are Raspberry Pi's going to be easily found online again for purchase? I've eyed them every few months for the past year and have seen in stock 0 times.
- r12343a_19 4y agoSadly I've let go. Switched to some other small and fanless things. Surprisingly with x86-64!
- kelnos 4y agoIt does seem to be getting slightly better. I just looked at rpilocator.com, and it claims 12 different models are available from some retailers (none in the US, though). The models available are... not exactly desirable. But the last time I looked, and all prior times, for the past year or two, I would see at most one or two models available, and often just nothing. So it's still useless, but... less useless than before? And maybe that means it'll get to a point where useful models are available again soonish?
- momirlan 4y agosame here moved on to ODROID, and not looking back .
- BMc2020 4y agoI just bought a win 10 mini pc for $91. It's insane. It's back up to $99 now (I got it discounted). It works fine. https://www.amazon.com/dp/B0BHP34TH1?ref=ppx_yo2ov_dt_b_product_details&th=1 https://www.amazon.com/dp/B0BHP34TH1?ref=ppx_yo2ov_dt_b_prod...
- genpfault 4y agoWhat's the driver situation with Bookworm on the Raspberry Pi 4 with UEFI? Has v3d[1] been ACPI-ized[2]? [1]: https://www.kernel.org/doc/html/latest/gpu/v3d.html https://www.kernel.org/doc/html/latest/gpu/v3d.html [2]: https://wiki.debian.org/RaspberryPi4#Using_EFI_Firmware_and_the_regular_Debian_Installer https://wiki.debian.org/RaspberryPi4#Using_EFI_Firmware_and_...
- Fnoord 4y agoDoes this (TianoCore) work on the Raspberry Pi Compute Module 4 (CM4)?
- windex 4y agoRaspberry PIs are mythical beasts where Iam at. They are being resold at atrocious prices by scalpers very likely in connivance with the official channels.