Teddy Reed wrote libSboot 3 years ago, and I am just noticing it. š¦ This “Secure Boot” is different than the UEFI definition/implementation, and is U-Boot-specific. Excerpting the readme:
libSboot provides an example ‘Secured Boot’ for U-Boot and a U-Boot Second Phase Loader (SPL). libSboot attempts to define an example of how a platform can measure a pre-OS boot environment, thus providing a capability to ensure that a libSboot-enforced OS is only loaded in an owner-authorizedĀ fashion. A ‘Secure Boot’ concept is a common means to ensure platform security and integrity; understand that there are many implementations of a ‘Secure Boot’.Ā libSboot uses a TPM v1.2 to implement a secure boot using a static root of trust measurement (SRTM). The static adjective implies a ‘read-only’Ā attribute, meaning libSboot expects its initialization to occur from ROM code.Ā During this initialization libSboot performs a TPM_Start, TPM_SelfTest andĀ checks that the TPM is neither deactivated nor disabled. The TPM must have its NVRAM locked, meaning access control is enforced. Initialization then checksĀ each PCR used to measure the pre-boot environment and verifies they are reset. Finally Physical Presence is asserted to satisfy NVRAM read/write permissions.
https://github.com/theopolis/sboot
https://github.com/theopolis/u-boot-sboot
http://www.trustedcomputinggroup.org/community/2013/03/securing_embedded_devices_with_the_tpm__a_schmoocon_talk
http://prosauce.org/blog/2013/2/11/embedded-trust-p2-u-boot-secured-boot.html
Firmware Security 