4 ms·

If it isn’t machine checkable, it is a complete waste of time. There are plenty of examples of people at the actual vendor behaving maliciously; often under go

by hedora 3y ago

If it isn’t machine checkable, it is a complete waste of time. There are plenty of examples of people at the actual vendor behaving maliciously; often under government orders. However, there’s a pretty simple way to make sure the bill of materials can be checked by machine: Require the firmware blob to be reproducibly buildable from source, and mandate distribution of the source code of the firmware. Doing this doesn’t preclude signing the result of the build and then distributing the signature instead of the signing key. I’d personally prefer it if vendors also had to distribute signing keys, but that’s a separate question.

rollcat 3y ago
> I’d personally prefer it if vendors also had to distribute signing keys, but that’s a separate question. This would completely and entirely defeat the purpose of signing. Once a private (signing) key is no longer private, it's useless.
- hedora 3y ago
  Exactly! I think that'd be great. You can disagree, and it is unlikely that you'll change my mind. A nice compromise is what my old Acer laptop does. You can disable the windows public key, and put your own in place if you want to run a CA, or you can just tell it to trust whatever boot loader is currently installed (and lock it to that boot loader, so now it won't boot Windows or even Ubuntu, but it will boot the Linux or BSD you installed). You can also disable the security checks if you want to.
  - rollcat 3y ago
    > You can disagree, and it is unlikely that you'll change my mind. I'm not looking to change your mind, merely pointing out how absolutely pointless is signing if private keys are public. At that point just don't sign, and don't add the silicon/firmware that verifies the signatures - less cost designing/testing/manufacturing/supporting the hardware. The point of signing the firmware/bootloader is to make it more difficult to employ boot chain exploits. If you don't care that anything that even briefly gains root on your machine (curl|sudo bash) can proceed to permanently backdoor your OS in a way that's undetectable from the inside, just disable signing. /shrug > A nice compromise is what my old Acer laptop does. You can disable the windows public key, and put your own in place if you want to run a CA, or you can just tell it to trust whatever boot loader is currently installed [...]. Either Microsoft, or the EFI standards body (under MS's direction; can't remember the details here) mandates that users must be able to enroll their own signing keys, at least on x86. I haven't run into PC hardware that doesn't allow you to do this, but then I'm not dealing with a lot of PC hardware regularly. The story is a bit different with Arm EFI - Microsoft tried to ape Apple and make it mandatory to NOT be able to enroll new first-party keys; meanwhile Apple skipped EFI on Arm Macs, and just allowed third-party OS's like they did on Intel. I'm not sure what's the story with signing a third-party OS on the Arm Macs, but I wouldn't like to run one unsigned.

by hedora 3y ago

rollcat 3y ago

> I’d personally prefer it if vendors also had to distribute signing keys, but that’s a separate question. This would completely and entirely defeat the purpose of signing. Once a private (signing) key is no longer private, it's useless.

hedora 3y ago
Exactly! I think that'd be great. You can disagree, and it is unlikely that you'll change my mind. A nice compromise is what my old Acer laptop does. You can disable the windows public key, and put your own in place if you want to run a CA, or you can just tell it to trust whatever boot loader is currently installed (and lock it to that boot loader, so now it won't boot Windows or even Ubuntu, but it will boot the Linux or BSD you installed). You can also disable the security checks if you want to.
- rollcat 3y ago
  > You can disagree, and it is unlikely that you'll change my mind. I'm not looking to change your mind, merely pointing out how absolutely pointless is signing if private keys are public. At that point just don't sign, and don't add the silicon/firmware that verifies the signatures - less cost designing/testing/manufacturing/supporting the hardware. The point of signing the firmware/bootloader is to make it more difficult to employ boot chain exploits. If you don't care that anything that even briefly gains root on your machine (curl|sudo bash) can proceed to permanently backdoor your OS in a way that's undetectable from the inside, just disable signing. /shrug > A nice compromise is what my old Acer laptop does. You can disable the windows public key, and put your own in place if you want to run a CA, or you can just tell it to trust whatever boot loader is currently installed [...]. Either Microsoft, or the EFI standards body (under MS's direction; can't remember the details here) mandates that users must be able to enroll their own signing keys, at least on x86. I haven't run into PC hardware that doesn't allow you to do this, but then I'm not dealing with a lot of PC hardware regularly. The story is a bit different with Arm EFI - Microsoft tried to ape Apple and make it mandatory to NOT be able to enroll new first-party keys; meanwhile Apple skipped EFI on Arm Macs, and just allowed third-party OS's like they did on Intel. I'm not sure what's the story with signing a third-party OS on the Arm Macs, but I wouldn't like to run one unsigned.