Re: GRUB hardened boot framework

[Jan Alsenz]

Robert Millan wrote:
> On Sat, Feb 28, 2009 at 12:18:17AM +0100, phcoder wrote:
>>> If the code that does the authentication is loaded from the encrypted 
>>> partition,
>>> without being checked, this is true, but we assume, that core.img is already
>>> loaded (and checked), so the authentication code is not on the encrypted
>>> partition, and can detect any tampering.
>> As far as I understood Robert Millan was suggesting that just encrypting  
>>  (but not verifying) your kernel is enough. I wanted to show wha it isn't
> 
> Fair enough.  My point is that we don't need overcomplicated mechanisms to
> measure every module, config file or component separately.  After core.img
> is verified/loaded, it's much simpler to handle the rest at this layer
> below the filesystem, which doesn't require significant redesign of how
> GRUB works.

Well, the problem there will probably be, that no commonly used disk encryption
(e.g. dm-crypt) uses checksums (as far as I know), when reading from disk. So if
you want to be compatible, the check of the files needs to be done either by the
filesystem (which only very few can do), or by a separate layer.
Which brings us back to the initial idea.

In any case, for all the crypto stuff it would be a good idea, to have some
general GRUB crypto-library, that everyone could use. Probably like it is done
in the linux kernel.
This could then also be used for the password command.

Greets,

Jan

signature.asc
Description: OpenPGP digital signature