Home / Series / Chaos Communication Congress / Aired Order / Season 33 / Episode 145

Virtual Secure Boot

Speaker: Gerd Hoffmann Over the last two years secure boot support for virtual machines was added to qemu, kvm (linux kernel) and ovmf (edk2/tianocore). This talk covers the implementation details and the issues we had to deal with along the way. Well, to be exact ovmf (open virtual machine firmware, part of tianocore) has support for the secure boot interfaces for a long time already. But it used to not provide any actual security, the guest os could easily tamper with the secure boot variable storage by simply writing to the (virtual) firmware flash. This is no longer the case now. Making secure boot actually secure was a bigger effort than we initially expected and it required changes in three software projects: kvm got smm emulation support. qemu got smm emulation support, and the q35 chipset emulation needed some fixes and improvements too. ovmf makes use of the smm lockbox now as tamper-resitant storage for secure boot variables (and some other bits).

English
  • Originally Aired December 30, 2016
  • Runtime 60 minutes
  • Production Code 8142
  • Created December 28, 2016 by
    Administrator admin
  • Modified December 28, 2016 by
    Administrator admin