Dear Bruce,
In general the system firmware does not have protected time source so the
expiration date of the certificate is ignored for Secure Boot verification.
(A bad actor could just change the system date to re-enable a certificate.)
In a particular system design that did have a time source with protection
(from unauthorized alteration) this check could be added if desired.
But it is not required by UEFI.
A related area is Time Stamp Checking related to dbt variable added in 2.4.
Simplified Understanding of How UEFI Timestamp Authentication Feature Works
-
1) The dbt variable is (factory or OS) provisioned with one or more
timestamp service public certificates.
2) UEFI executables signed by the CA are also immediately
counter-signed by the time stamp authority
3) So, if the signature of an executable is signed by a trusted
timestamp certificate, them firmware can trust the indicated time of signing
by CA
4) When time of signing is trusted, the processing of certificates
added to dbx is altered, and executables signed prior to the certificates
time of revocation can be allowed to run while still blocking executables
signed later (or lacking trusted timestamp)
---Jeff Bobzin
Insyde Software
-----Original Message-----
From: Bruce Cran [mailto:[email protected]]
Sent: Tuesday, July 8, 2014 10:59 AM
To: [email protected]
Subject: [edk2] Signing binaries and timestamping
Having used Authenticode on Windows, I know that without a timestamp the
signature will be considered invalid once the certificate has expired.
Is the same true with UEFI?
I don't see anything about timestamping in the documentation
(SigningUefiImages etc.) but on Windows 8.1 Microsoft's EFI files in
C:\Windows\boot\EFI _are_ timestamped.
Is the current date considered when determining whether a signature is valid
under UEFI?
--
Bruce
----------------------------------------------------------------------------
--
Open source business process management suite built on Java and Eclipse
Turn processes into business applications with Bonita BPM Community Edition
Quickly connect people, data, and systems into organized workflows
Winner of BOSSIE, CODIE, OW2 and Gartner awards
http://p.sf.net/sfu/Bonitasoft
_______________________________________________
edk2-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/edk2-devel
------------------------------------------------------------------------------
Open source business process management suite built on Java and Eclipse
Turn processes into business applications with Bonita BPM Community Edition
Quickly connect people, data, and systems into organized workflows
Winner of BOSSIE, CODIE, OW2 and Gartner awards
http://p.sf.net/sfu/Bonitasoft
_______________________________________________
edk2-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/edk2-devel
