Re: AMD Secure Encrypted Virtualization - FreeBSD Status?

Grarpamp,Tomasz, and all:

Thanks for all the reference documents. I looked through them, and did some
more research myself:

Creating Secure Boot Keys
---
0.
https://wiki.freebsd.org/SecureBoot
A work in progress.
---
1.
http://www.rodsbooks.com/efi-bootloaders/controlling-sb.html
Need:
openssl - pkg on freebsd
efitools - not found freebsd, source available elswhere
Note that efitools is dependent upon sbsigntool (aka sbsigntools), so you
may need to install it, too.
sbsigntool - not found freebsd, source available elswhere
---
2.
https://www.linuxjournal.com/content/take-control-your-pc-uefi-secure-boot
Similar tools to Rod's, added osslsigncode as possible substitute for
sbsigntool
---
My situation in life does not really seem to demand secure boot as I can
always wipe the drive and rebuild. However it was pointed out that malware
can continue to hide in the bios cmos nvram, so there is really no hiding
and yes, we do need to consider shaping up.

I am a big fan of Rod Smith ( http://www.rodsbooks.com/ ) and use his
rEFInd boot loader on both my machines. It was a little trouble to set up
the first time, but well worth the effort. I suspect that creating secure
boot keys is a bit more complicated, but I'm going to look into it deeper.
Any help & suggestions would be appreciated.

My trusty old 2014 HP Pavilion has it's HP vendor platform keys, but they
are not enabled. I have it in CSM mode, not UEFI mode, hence no secure boot
as uefi must be enabled for secure boot.

My new Ryzen 7 3700X & MSI X570 motherboard has UEFI boot set, but secure
boot is not enabled. I have not even "enrolled" the vendor keys yet.

So I have a lab setup to play with two machines, old & new, and the time &
patience to play with this. I do welcome any suggestions and help

Clay


On Thu, Oct 3, 2019 at 7:01 PM grarpamp <grarpamp_at_gmail.com> wrote:

> >> Just whose secure keys do you suggest? I go to a lot of trouble to
> disable
> >> secure boot so I can load any operating system I want.
>
> Some motherboards have BIOS that allows you to both
> - Upload your own keys
> - Delete all the spooky Microsoft keys
>
> Read the UEFI Secure Boot specification document.
> Then paste all the key management specs into a ticket
> with your motherboard vendor and get on them to publish
> a BIOS release that has proper key management functions.
>
> Some BIOS makers have this as selectable options in their
> BIOS reference build routines... ie: the motherboard maker doesn't
> have to write any code, they just point and click, and the option
> appears in a BIOS release for mobo end user customers.
>
> Sometimes you have to bug and escalate the mobo makers
> and threaten to walk your next purchase to another mobo maker
> to get them to cut and post the new BIOS release.
>
> https://www.uefi.org/
> https://uefi.org/learning_center/papers
> https://uefi.org/specsandtesttools
> https://uefi.org/sites/default/files/resources/UEFI_Spec_2_8_final.pdf
>
>
> https://uefi.org/sites/default/files/resources/UEFI_Secure_Boot_in_Modern_Computer_Security_Solutions_2019.pdf
>
> https://uefi.org/sites/default/files/resources/UEFI%20Forum%20White%20Paper%20-%20Chain%20of%20Trust%20Introduction_2019.pdf
>
>
> > The goal would be not to disable secure boot and have FreeBSD running
> > with a secured bootloader :-)
> >
> > At the moment we have insecure boot + insecure kernel + possible
> > encrypted data partition..
>
> > would be really nice also to get UEFI BOOT compatible with SECURE BOOT
> :-)
>
> Yes.
> _______________________________________________
> freebsd-current_at_freebsd.org mailing list
> https://lists.freebsd.org/mailman/listinfo/freebsd-current
> To unsubscribe, send any mail to "freebsd-current-unsubscribe_at_freebsd.org"
>