Improving Platform Security With UEFI Secure Boot And UEFI Variables

presented by Improving Platform Security with UEFI Secure Boot and UEFI Variables UEFI Spring Plugfest – March 29-31, 2016 Presented by David Chen (Insyde Software) Updated 2011-06-01 UEFI Plugfest – March 2016 www.uefi.org 1

Agenda UEFI Plugfest – March 2016 Introduction UEFI Variables New Secure Boot Model Call For Action www.uefi.org 2

Introduction UEFI Plugfest – March 2016 www.uefi.org 3

Variables may be attacked POST RT VarA VarB UEFI Plugfest – March 2016 www.uefi.org 4

Current Secure Boot Model User Mode Setup Mode Enroll PKpub PKpub NULL SetupMode 1 SecureBoot 0 1. Delete PKpub 2. Platform-Specific PKpub Clear Secure Boot Ready To Go Secure Boot Off UEFI Plugfest – March 2016 PKpub ! NULL SetupMode 0 SecureBoot 1 www.uefi.org 5

UEFI Variables UEFI Plugfest – March 2016 www.uefi.org 6

Protect the Variables Set Variable without RT attribute BS RT BS Variable Lock Critical Variables UEFI Plugfest – March 2016 www.uefi.org 7

UEFI Secure Boot Database 2.3.1 db Update Enable 2.4 If signed by key in dbt, dbt Check cert’s timestamp! Update Enable 2.5 Update Enable If signed by key in dbr, dbr loader can Run for recovery! 2.3.1 2.3.1 2.3.1 PK KEK Update Enable If signed by key in db, driver/loader can Run! dbx If signed by key in dbx, driver/loader forbidden! Update Enable UEFI Plugfest – March 2016 www.uefi.org 8

Scenario to use dbt Before UEFI Specification v2.4 KeyPriv Images (signed earlier) dbx If signed by key in dbr, loader can Run for recovery! Images (signed later) Certification UEFI Plugfest – March 2016 www.uefi.org 9

Scenario to use dbt After UEFI Specification v.2.4 KeyPriv Images (signed earlier) dbt Images (signed later) Certification UEFI Plugfest – March 2016 www.uefi.org 10

UEFI Variables Secure Boot Modes UEFI Plugfest – March 2016 SetupMode 2.3.1 AuditMode 2.5 DeployedMode 2.5 www.uefi.org 11

New Secure Boot Model UEFI Plugfest – March 2016 www.uefi.org 12

Why Audit/Deployed Mode? Customers (ex: data center, government, etc.) have different requirement for secure boot database. But the Secure Boot Database isn’t easy to be customized with the old model! UEFI Plugfest – March 2016 www.uefi.org 13

Audit Mode User Mode PKpub ! NULL AuditMode 0 (RW) SetupMode 0 SecureBoot 1 Log more info to IEIT Audit Mode Set AuditMode to1 1. Delete PKpub 2. Platform-Specific PKpub Clear Enroll PKpub PKpub NULL AuditMode 0 (RW) SetupMode 1 SecureBoot 0 UEFI Plugfest – March 2016 www.uefi.org PKpub NULL AuditMode 1 (RO) SetupMode 1 SecureBoot 0 14

Deployed Mode PKpub ! NULL AuditMode 0 (RO) DeployedMode 1 (RO) SetupMode 0 SecureBoot 1 Platform-Specific DeployedMode Clear Set DeployedMode to1 User Mode 1. Delete PKpub 2. Platform-Specific PKpub Clear Setup Mode PKpub ! NULL AuditMode 0 (RW) DeployedMode 0 (RW) SetupMode 0 SecureBoot 1 Deployed Mode Enroll PKpub Enroll PKpub PKpub NULL AuditMode 0 (RW) DeployedMode 0 (RO) SetupMode 1 Set AuditMode to1 SecureBoot 0 PKpub NULL AuditMode 1 (RO) DeployedMode 0 (RO) SetupMode 1 SecureBoot 0 Audit Mode UEFI Plugfest – March 2016 www.uefi.org 15

Call For Action UEFI Plugfest – March 2016 www.uefi.org 16

Call For Action Critical variables need to be protected Customers need more flexible customized secure boot databases Update your spec to adopt new secure implementation to enhance your platform’s security UEFI Plugfest – March 2016 www.uefi.org 17

Thanks for attending the UEFI Spring Plugfest 2016 For more information on the Unified EFI Forum and UEFI Specifications, visit http://www.uefi.org presented by UEFI Plugfest – March 2016 www.uefi.org 18

Backup UEFI Plugfest – March 2016 www.uefi.org 19

UEFI Variables Secure Boot Databases 2.3.1 2.3.1 2.3.1 Platform Key (PK) Key Exchange Key Database (KEK) Secure Boot Signature Database (db) Secure Boot Blacklist Signature Database (dbx) 2.4 Secure Boot Timestamp Signature Database (dbt) 2.5 Secure Boot Authorized Recovery Signature Database (dbr) 2.3.1 UEFI Plugfest – March 2016 www.uefi.org 20

Secure Boot Databases Platform Key (PK) Key Exchange Key Database (KEK) Secure Boot Signature Database (db) Secure Boot Blacklist Signature Database (dbx) Secure Boot Timestamp Signature Database (dbt) Secure Boot Authorized Recovery Signature Database (dbr) UEFI Plugfest -March 2016 www.uefi.org 20 2.3.1 2.3.1 2.5 2.4 .