TechPrufer
Get started
Two Sigma
Two Sigma logoTwo Sigma · Feature trail

Secure Boot and System Attestation

3 posts · Dec 2017 – Oct 2020

What this trail covers

Two Sigma is developing capabilities to enhance the security of Linux boot processes on laptops and servers. This involves leveraging UEFI firmware features like Platform Key enrollment for kernel and initrd signing, and Trusted Platform Module (TPM) integration for protecting disk encryption keys. The system aims to prevent tampering with the boot process, detect persistence attempts, and provide remote attestation of system integrity. This post introduces 'safeboot', a package that makes it easy to take a

All Two Sigma trails
  1. safeboot: Improving the Safety of Booting Linux on Normal LaptopsIntroduced 'safeboot', a package that simplifies the configuration of UEFI firmware security features for Linux laptops. This includes enrolling custom keys as Platform Keys for kernel/initrd signing, protecting disk encryption keys with TPM hardware (requiring only a user PIN), and leveraging TPM PCRs and monotonic counters to prevent physical tampering and boot process rollback. It also enhances resiliency by detecting persistence attempts and providing remote attestation of system integrity. The post discusses the threat model for corporate laptops, the usability trade-offs compared to default Linux distributions, and outlines future work on distribution support, Xen integration, fleet management, and cosign integration.
  2. LinuxBoot: A Fast, Reliable Open Source Firmware for Linux ServersThis post details the collaboration with Google, Facebook, Horizon Computing, and the Open Compute Project to build LinuxBoot, an open-source firmware for servers that replaces proprietary UEFI. LinuxBoot uses a minimal GNU/Linux kernel and an initrd runtime, allowing for customization of the boot process, device handling, and establishment of a hardware root of trust for early boot security and remote attestation.
  3. Bringing Linux back to the Server BIOS with LinuxBootThis post details the NERF and Heads projects, which replace vendor firmware with a reproducible Linux runtime for server BIOS. It enables open-source software control from early in the boot process, enhancing cloud security by moving away from proprietary firmware.