Re: [RFC 3/4] FIT: add FIT image support

[Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>]

On 16:41 Fri 13 Mar     , Jan Lübbe wrote:
> On Fr, 2015-03-13 at 15:28 +0100, Jean-Christophe PLAGNIOL-VILLARD wrote:
> > > It's not the job of barebox to define security policies, it must fit
> > > well into the larger security design, which may require compromises.
> > 
> > I disagree, disable by default non secure feature is require to pass
> > secure boot certification
> 
> Is there a specific certification you are targeting?

yes but can not give details all under NDA, a book of more than 500 pages
for bootloader/linux/kernel & co
> 
> How do you intend to handle console access in verified boot mode?
> Allowing access to md/mw would break any security.

it's already mainline for month, check password support

as I put it in production more than 1 years ago

or simple disable input console all time, the code is here

the main problem is not console but env you need to drop RW env support
and use only RO one, except for keyring support where you will a RW env but
not executable and only accesable by crypto API

otherwise you need to use a secured digest such as HMAC/CMAC/OMAC support
to sign the env at runtime and ensure the symetric key is secured
or encrypt it via aes (did this in the past)

==
ww may have to get secured malloac with part where the md/mw and any other
API can not touch only the crypto API

but this will be for later
==
> 
> I was thinking about switching off access to the HW AES keys as soon as
> a prompt appears. At least on MX28/MX6 that's possible and important.

Password & defaultenv2

16 characters min password with sha256 min or best sha512 or pbkdf2

I'll send a patch to use the pbkdf2 for password

Best Regards,
J.
> 
> Regards,
> Jan
> -- 
> Pengutronix e.K.                           |                             |
> Industrial Linux Solutions                 | http://www.pengutronix.de/  |
> Peiner Str. 6-8, 31137 Hildesheim, Germany | Phone: +49-5121-206917-0    |
> Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |
> 

_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox