Comments for James Bottomley's random Pages

Comment on Owning your Windows 8 UEFI Platform by jejb

jejb — Tue, 14 May 2013 13:37:26 +0000

yes, that’s right (it’s what man sign-efi-sig-list says). You need a final step where you create the authorised update from the smime signed bundle:

sign-efi-sig-list -a -i KEK.signed -t ‘May 13 00:00:00 UTC 2013′ KEK KEK.auth

and the -a and -t flags have to match exactly what you passed in to create KEK.forsig

If you don’t need a detached signature, it’s easier just to do it all in one go:

sign-efi-sig-list -a -c PK.crt -k PK.key KEK KEK.esl KEK.auth

You also have to be careful about the -a flag. You have to make sure that you use KeyTool update (or UpdateVars -a) because the update flag is part of the signature (if you use KeyTool replace, or UpdateVars without the -a, you have to leave the -a off the sign-efi-sig-list input).

Comment on Owning your Windows 8 UEFI Platform by Peter Barnsley

Peter Barnsley — Mon, 13 May 2013 13:56:57 +0000

Hi James, if I run:

sign-efi-sig-list -a -t ‘May 13 00:00:00 UTC 2013′ -o KEK KEK.esl KEK.forsig

would I be right in thinking that the correct way to sign the list is to do it like this:

openssl smime -sign -binary -in KEK.forsig -out KEK.signed -signer PK.crt -inkey PK.key -outform DER -md sha256

The bit I am querying is the bit at the end where I sign the KEK with the PK. I presume this is the right way to do it – so that when I run keytool it will recognise that the signature list entry has been signed by the PK?

Thanks

Comment on The ARM Windows 8 Lockdown by tobyReme

tobyReme — Thu, 18 Apr 2013 21:19:28 +0000

The patent licensing agreements that Microsoft has with Samsung and many more for Android are secret agreements. It is known that they cover more than royalties. Is this not one way that Microsoft, despite a tiny share of tablet sales, could enforce a secure boot regime similar to that in the PC world?

Comment on Owning your Windows 8 UEFI Platform by tobyReme

tobyReme — Thu, 18 Apr 2013 18:58:21 +0000

Can the changes to the BIOS be read by Windows 8 – this would create a possibility for mischef on behalf of a certain OS vendor. If not now, could this facility be added – that is , key comparison with the original keys?
Will a efi / bios update trash the installed keys?
I am not technical, just a Linux user determined to stay that way.
Sorry if I missed any reference to these questions in earlier articles or in discussions.
Thanks for the work. I agree with the point of view that it is better to work around these issues than to ignore them. Andrew Tridgell and the Samba project should be the guide – persistence and anti-competition cases put to the EU.

Comment on Owning your Windows 8 UEFI Platform by light

light — Sat, 13 Apr 2013 17:35:56 +0000

haha… it seems you have taken an alpha blog post for good fish… unlucky mate… and shame on the blogger who made it seem more trivial than it is probably

If at least we Europeans don’t f*cking clamp down on this… I can’t personally even see secureboot be enabled by default, ahead of disabled… in Europe.. if so, humans are game over .. nothing but meat as all US greed is about, no ethics, no morals, no values, no integrity… nothing. I was more extreme and saying ban all US products already in 99-2000 but I am always 10-15 years ahead in time to others. neo-nazism here we come ^^

Comment on Owning your Windows 8 UEFI Platform by Barry Hoffman

Barry Hoffman — Sat, 13 Apr 2013 00:56:37 +0000

Hmm. What good is a backup of the Platform Key then?

What did you mean by “These files can later be used to restore the contents if something goes wrong in the updates (and because some platforms put you into setup mode by erasing the contents of all the secure variables), so save them in a safe place.”

Thanks,
Barry

Comment on Owning your Windows 8 UEFI Platform by jejb

jejb — Sat, 13 Apr 2013 00:19:20 +0000

Nothing really: under UEFI rules the Platform Key has to be updated as a signed file. That means you can’t put it back as an esl file, it has to be an auth file and, if you’re trying to replace the original platform key, there’s no real way to get an auth file (because you don’t have the private part of the platform key). That said, a lot of platforms don’t obey the only signed PK updates rule, so perhaps I should allow .esl files here and let the platform report a security violation if it only accepts signed updates.

If you installed the efitools package, it should have generated a signed platform key update file called PK.auth for you

Comment on Owning your Windows 8 UEFI Platform by Barry Hoffman

Barry Hoffman — Fri, 12 Apr 2013 23:04:40 +0000

OK, I’ve run into a little bit of trouble with KEYTOOL.EFI. I saved a copy of all the keys into .esl files as you suggested. However, I must have done something wrong because the Platform Key is cleared but when I try to reload it from the backup PK.esl file, KEYTOOL.EFI never seems to locate the file. It just keeps saying “Select File containing additional key for The Platform Key (PK)”. When I navigate to the directory where I saved the PK.esl file KEYTOOL.EFI doesn’t see it. What did I do wrong?

Thanks,
Barry

Comment on The ARM Windows 8 Lockdown by anon

anon — Mon, 08 Apr 2013 09:10:06 +0000

On a UEFI PC with secureboot people have the option to disable the secureboot bot not for ARM devices.so why not give the ARM device more priority

Comment on efitools 1.4 with linux key manipulation utilities released by Kano

Kano — Sun, 07 Apr 2013 01:51:01 +0000

Any update about a timeout feature and new signed binaries?