SUSE Labs Conference 2018 - EFI key - A new master key type in Linux kernel
Channel: SUSE Labs
Date: 2018-09-18

This topic is derived from the hibernation encryption and authentication.

The EFI boot services variable can only be accessed by the signed efi binaries when secure boot is enabled by user. We can use the mechanism to store a random number in boot services variable as a root key. The root key can be used to encrypt and authenticate other keys in key retention service in Linux kernel. It can be a new key type.

This talk will introduce the EFI key: 

- ERK (EFI Root Key) 
   + EFI stub generates a random key and stores in EFI boot services variable. 
   + The ERK is secure when secure boot enabled. 
   + ERK can be a secret to encrypt a random number for generate a EFI key 
- EFI key: 
   + A new master key type to key retention service. 
   + A new option beyond trusted key(TPM) and user key. 
   + The EFI key can be used by hibernation encryption/authentication. 
   + The EFI key can be a master key to generate a encrypted key for EVM. 
- The rescue mechanism for ERK.



Joey Lee