Dynamic Key Managed PowerPC Guest Secure Boot - Sudhakar Kuppusamy & George Wilson
Channel: The Linux Foundation
Date: 2023-05-25

Dynamic Key Managed PowerPC Guest Secure Boot - Sudhakar Kuppusamy & George Wilson, IBM's Linux Technology Center
Boot-level attacks can be silent and persistent. Malicious Grand Unified Bootloader (GRUB), GRUB modules, kernel, or kernel modules can subvert the entire OS every time it starts. Until recently, we have very few mechanisms to verify boot components for Power Logical Partitions (LPARs), one of that is static key solution. While a static key secure boot has been available in distros for over a year, it has proven to have a number of shortcomings. A new dynamic key secure boot has been proposed to improve Power secure boot, which includes using a new hypervisor Platform KeyStore to effect authenticated variables that are used to verify appended signatures on Power GRUB and kernels. This talk discusses the shortcomings of static key secure boot in Power LPARs, new mechanisms for dynamic key management, and proposes extending the GRUB Secure Boot Advanced Targeting (SBAT) concept into the kernel.