← Back to the reading view
Slides · 7 slides
Secure boot: a chain of signatures from the first instruction to the OS
The same use case told visually, ready to present. Speaker notes carry the full explanation.
Firmware Integrity
Secure boot
A chain of signatures from the first instruction to the operating system
Each arrow is a signature check; the first box is trusted because it can't change
Secure boot: a chain of signatures from the first instruction to the OS · Classical Crypto Today1 / 7
Root of trust
A key you can't overwrite
NIST SP 800-193: protect, detect, recover
Secure boot: a chain of signatures from the first instruction to the OS · Classical Crypto Today2 / 7
UEFI
PK, KEK, db and dbx
Secure boot: a chain of signatures from the first instruction to the OS · Classical Crypto Today3 / 7
Two mechanisms
Verified boot versus measured boot
Secure boot: a chain of signatures from the first instruction to the OS · Classical Crypto Today4 / 7
Measured boot
Extending a PCR
Secure boot: a chain of signatures from the first instruction to the OS · Classical Crypto Today5 / 7
Where it breaks
Old signed code with a known bug
Signatures stop unsigned code; revocation and rollback stop the rest
Secure boot: a chain of signatures from the first instruction to the OS · Classical Crypto Today6 / 7
Key management
The root key is still just a key
Plan a trust anchor's rollover from the day it is created
Secure boot: a chain of signatures from the first instruction to the OS · Classical Crypto Today7 / 7
1 / 7
Keys: ← → move, F full screen, G all slides, N notes