Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Spell out some Secure Boot requirements #22

Merged
merged 2 commits into from
Jul 29, 2024
Merged

Spell out some Secure Boot requirements #22

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1936a6c
Expand acronym
andreabolognani Jul 29, 2024
a7d52dc
Require full control of Secure Boot
andreabolognani Jul 29, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion server_platform_requirements.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -154,13 +154,15 @@ PCIe devices or be compliant to rules for SoC-integrated PCIe devices (cite:[Ser

Security requirements straddle hardware and firmware.

TBD: it is expected the high-level RoT / boot flow requirements will come from the platform security spec.
TBD: it is expected the high-level root of trust / boot flow requirements will come from the platform security spec.

[width=100%]
[%header, cols="5,25"]
|===
| ID# ^| Requirement
| `SEC_010` | MUST implement UEFI Secure Boot and Driver Signing (cite:[UEFI] Section 32)
| `SEC_011` | It MUST be possible for a physically present user to disable Secure Boot enforcement, thus allowing unsigned code to be executed.
| `SEC_012` | It MUST be possible for a physically present user to fully manage the contents of all Secure Boot key stores (PK, KEK, db and dbx). This includes the ability to delete all factory-provided keys, enrolling their own custom keys, and resetting all key stores to their factory state.
| `SEC_020` | MUST back the UEFI Authenticated Variables implementation with
a mechanism that cannot be accessed or tampered by an unauthorized
software or hardware agent.
Expand Down
Loading