TechPrufer
Get started
Cloudflare
Cloudflare logoCloudflare · Feature trail

Arm Secure Boot Chain Enhancement

2 posts · Nov 2020 – Jan 2023

What this trail covers

Cloudflare has enhanced its secure boot capabilities for Arm-based servers by implementing a Single Domain Secure Boot (SDSB) mechanism. This builds upon the Arm Trusted Firmware (ATF) Secure Boot process, allowing for cryptographic validation of the UEFI firmware using a hardware root-of-trust stored in eFuses. This provides a more robust security chain for Arm servers, similar to their existing solutions for x86 platforms.

All Cloudflare trails
  1. Armed to Boot: an enhancement to Arm's Secure Boot chainThis post details the implementation of Single Domain Secure Boot (SDSB) for Arm servers, specifically on Ampere Altra Max CPUs. SDSB extends the existing Arm Trusted Firmware (ATF) secure boot process by allowing a customer's public key hash to be stored in the SoC's eFuse. This enables the hardware root of trust to validate the entire UEFI firmware boot chain, including the BIOS. The process involves generating customer certificates, customizing UEFI firmware to enroll these certificates, signing the UEFI.slim file with the customer's private key, and programming the eFuse with the customer's public key hash during manufacturing.
  2. Anchoring Trust: A Hardware Secure Boot StoryThis post details Cloudflare's implementation of AMD's Platform Secure Boot (PSB) for its servers, establishing a hardware root of trust (HRoT) that precedes UEFI firmware-based trust. It explains the boot process, the limitations of UEFI secure boot against firmware attacks, and how PSB leverages the AMD Platform Security Processor (PSP) and an on-chip Boot ROM to authenticate the System ROM image before CPU reset. The post also outlines the Public Key Infrastructure (PKI) setup, including ODM and AMD signing keys, and the structure of the Certificate Signing Request (CSR) for BIOS signing keys.