Security: Difference between revisions
Jump to navigation
Jump to search
(Improved formatting) |
|||
| Line 10: | Line 10: | ||
* Support to encrypted block devices/volumes | * Support to encrypted block devices/volumes | ||
[[Bayou]] / [[coreinfo]] | [[Bayou]] / [[coreinfo]] have "BIOS password"-like feature, using SHA-1 hashes stored in NVRAM or the (flash) ROM chip. | ||
Coreboot can be full-secure solution for your hardware, without this issues, which have "legacy" BIOS: | Coreboot can be full-secure solution for your hardware, without this issues, which have "legacy" BIOS: | ||
Revision as of 15:15, 15 May 2010
This page explains how coreboot can help with various security aspects of your system, compared to closed-source, legacy BIOS/EFI/firmware implementations.
This page is work in progress!
Common security features
- Boot password (like BIOS password)
- RAM wiping after each boot
- Signature verification - to boot from payload only signing images
- Support to encrypted block devices/volumes
Bayou / coreinfo have "BIOS password"-like feature, using SHA-1 hashes stored in NVRAM or the (flash) ROM chip.
Coreboot can be full-secure solution for your hardware, without this issues, which have "legacy" BIOS:
Current BIOS issues
RAM wiping
- http://citp.princeton.edu/memory/
- Coreinfo as demo payload for coreboot, showing your RAM contents after a cold boot.
SMI issues
- http://www.ssi.gouv.fr/fr/sciences/fichiers/lti/cansecwest2006-duflot.pdf
- http://tracker.coreboot.org/trac/coreboot/ticket/42
ATA issues
- http://coreboot.org/pipermail/coreboot/2005-May/011686.html
- http://www.heise.de/ct/english/05/08/172/
Firewire issues
- http://md.hudora.de/presentations/firewire/
- http://www.hermann-uwe.de/blog/physical-memory-attacks-via-firewire-dma-part-1-overview-and-mitigation