Authenticated Boot and Disk Encryption on Linux (2021)

Post by transpute » Mon, Sep 02, 2024, 6:58 AM UTC

  Developing trustworthy Linux-based systems in an open-source way
  Common git repo for hosting Boot-firmware
  Accelerating Linux Kernel Boot-Up for Large Multi-Core Systems
  Leveraging and managing SBAT revocation mechanism on distribution level
  Using U-boot as a UEFI payload
  Measured Boot, Secure Attestation & co, with systemd
  Secure Launch - DRTM solution on Arm platforms
  no more bootloader: please use the kernel instead
  OF != UEFI

Post by fsflover » Mon, Sep 02, 2024, 7:36 AM UTC

Post by ongy » Mon, Sep 02, 2024, 7:55 AM UTC

fsflover wrote: post #4

I'm surprised that the author doesn't mention Pureboot [0] or even Heads [1], the most user-friendly [2] way to use TPM on Linux and authenticate the boot process along with /root, /boot directories. Also, there is no Microsoft involved in my laptop, i.e., the author's statement > Microsoft's certificates are basically built into all of today's PCs is wrong. I enjoy the coreboot with Heads on my Librem 14 with my own…

Post by ahartmetz » Mon, Sep 02, 2024, 8:06 AM UTC

fsflover wrote: post #7

ongy wrote: post #6

Earlier quoted context omitted.

He's generally (I suspect p>99, probably a 9 more by volume) correct with his statement.

You are right, however the existence of alternatives is extremely important and should always be mentioned.

Post by jest3r1337 » Mon, Sep 02, 2024, 8:31 AM UTC

fsflover wrote: post #5

> the attacker takes the harddisk from your laptop while you aren't watching > You'll never notice they did that. Won't you be safe if you put a colorful nail polish to your laptop screws and take picture of its pattern? Then you regularly compare the actual pattern with your picture.