linuxboot / linuxboot/heads

Investigate coreboot hashing -> TPM extend timings for additional tamper evidence proof (spkmodem?)

Open
#2,185 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Makefile
Stars
1.6k
Forks
211
Avg merge
4d 21h
Merged PRs (30d)
6

Description

Had a crazy idea which is apparently not so new. We could introspect coreboot ticks per stages, and use it to improve tamper evidence.

  • cbmem -T provides timestamps of each stages and substages of boot
  • cbmem -c provides timestamps in logs, with ticks spent on each task, reported in cbmem -T

What if we modified coreboot to use spkmodem to report when regions are hashed, and time spent in each hashing? What if we "sang" this through spkmodem, through a seperate Kconfig to use spkmodem only to log those? We chould then have a proof that bootblock is hashing itself and next stages and so on with real time spent into hashing segments and tick count.

Just an idea I wanted written somwhere

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

The issue names no files or tests; start by reviewing cbmem -T and cbmem -c output alongside coreboot's spkmodem and Kconfig paths. A contribution would need to define the hashing events, timing evidence, and expected spkmodem output before implementation can be scoped.

Written by the indexing model from the issue text.

Assessment

Domain
embedded-iot, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.