Re: [edk2] Why does EDK2 disable time checks on certificates?
The OS can update the certificates by correct SetVariable() call with
authenticated payload (following UEFI secure boot / authenticated variable
definitions. Refer to the section 8.2 "Variable Services" and chapter 31
"Secure Boot and Driver Signing" for more details).
I am not sure if current OS will enforce any periodical update. Currently, UEFI
is just distributing the revocation list file to address possible security
risks (http://www.uefi.org/revocationlistfile).
Best Regards & Thanks,
LONG, Qin
-Original Message-
From: edk2-devel [mailto:edk2-devel-boun...@lists.01.org] On Behalf Of Bryan
Rosario
Sent: Tuesday, February 6, 2018 10:17 AM
To: Zhang, Chao B <chao.b.zh...@intel.com>
Cc: edk2-devel@lists.01.org; Alain Gefflaut <alain...@google.com>; Long, Qin
<qin.l...@intel.com>
Subject: Re: [edk2] Why does EDK2 disable time checks on certificates?
Thanks for the info.
Another question: if I enable time checks in my local copy of EDK2 (or if there
is another UEFI implementation with time checks enabled), do operating systems
generally update their certificates periodically to avoid them expiring?
In particular, I'm wondering about bootloaders that are signed for secure boot.
I've seen expiration times on the attached certificates and I'm wondering if
the bootloader will be periodically updated, or if operating systems will just
expect that the firmware doesn't actually enforce the expiration time.
On Mon, Feb 5, 2018 at 5:45 PM, Zhang, Chao B <chao.b.zh...@intel.com>
wrote:
> Bryan:
>You can reference EFI_CERT_X509_SHA256, EFI_CERT_X509_SHA384,
> EFI_CERT_X509_SHA512 data structure definition in UEFI spec.
> Now they are only supported in DBX. Revocation time here is defined
> by user instead of directly from Validity of X059 Certificate in order
> to address the issue mentioned below.
>
>
> -Original Message-
> From: edk2-devel [mailto:edk2-devel-boun...@lists.01.org] On Behalf Of
> Long, Qin
> Sent: Tuesday, February 6, 2018 8:55 AM
> To: Bryan Rosario <b...@google.com>; edk2-devel@lists.01.org
> Subject: Re: [edk2] Why does EDK2 disable time checks on certificates?
>
> It's EDK2-only.
> The current pre-boot environment have no trusted timer synchronization
> service. And it's very likely the system time is not the real-time
> (esp under dev environment). So the certificate time expiration
> checking was bypassed to avoid any boot break.
>
> Against the corresponding certificate revocation case, the UEFI
> introduced the DBX database (forbidden list) to address this.
>
>
> Best Regards & Thanks,
> LONG, Qin
>
> -Original Message-
> From: edk2-devel [mailto:edk2-devel-boun...@lists.01.org] On Behalf Of
> Bryan Rosario
> Sent: Tuesday, February 6, 2018 5:52 AM
> To: edk2-devel@lists.01.org
> Subject: [edk2] Why does EDK2 disable time checks on certificates?
>
> See here ("Currently certificate time expiration checking is ignored."):
> https://github.com/tianocore/tianocore.github.io/wiki/How-
> to-Enable-Security
> .
>
> Is this behavior part of the UEFI specification or is it EDK2-only?
> And what's the reasoning for it?
>
> Thanks,
> Bryan
> ___
> edk2-devel mailing list
> edk2-devel@lists.01.org
> https://lists.01.org/mailman/listinfo/edk2-devel
> ___
> edk2-devel mailing list
> edk2-devel@lists.01.org
> https://lists.01.org/mailman/listinfo/edk2-devel
>
___
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel
___
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel
Re: [edk2] Why does EDK2 disable time checks on certificates?
Thanks for the info.
Another question: if I enable time checks in my local copy of EDK2 (or if
there is another UEFI implementation with time checks enabled), do
operating systems generally update their certificates periodically to avoid
them expiring?
In particular, I'm wondering about bootloaders that are signed for secure
boot. I've seen expiration times on the attached certificates and I'm
wondering if the bootloader will be periodically updated, or if operating
systems will just expect that the firmware doesn't actually enforce the
expiration time.
On Mon, Feb 5, 2018 at 5:45 PM, Zhang, Chao B <chao.b.zh...@intel.com>
wrote:
> Bryan:
>You can reference EFI_CERT_X509_SHA256, EFI_CERT_X509_SHA384,
> EFI_CERT_X509_SHA512 data structure definition in UEFI spec.
> Now they are only supported in DBX. Revocation time here is defined by
> user instead of directly from Validity of X059 Certificate in order to
> address the issue mentioned below.
>
>
> -Original Message-
> From: edk2-devel [mailto:edk2-devel-boun...@lists.01.org] On Behalf Of
> Long, Qin
> Sent: Tuesday, February 6, 2018 8:55 AM
> To: Bryan Rosario <b...@google.com>; edk2-devel@lists.01.org
> Subject: Re: [edk2] Why does EDK2 disable time checks on certificates?
>
> It's EDK2-only.
> The current pre-boot environment have no trusted timer synchronization
> service. And it's very likely the system time is not the real-time (esp
> under dev environment). So the certificate time expiration checking was
> bypassed to avoid any boot break.
>
> Against the corresponding certificate revocation case, the UEFI introduced
> the DBX database (forbidden list) to address this.
>
>
> Best Regards & Thanks,
> LONG, Qin
>
> -Original Message-
> From: edk2-devel [mailto:edk2-devel-boun...@lists.01.org] On Behalf Of
> Bryan Rosario
> Sent: Tuesday, February 6, 2018 5:52 AM
> To: edk2-devel@lists.01.org
> Subject: [edk2] Why does EDK2 disable time checks on certificates?
>
> See here ("Currently certificate time expiration checking is ignored."):
> https://github.com/tianocore/tianocore.github.io/wiki/How-
> to-Enable-Security
> .
>
> Is this behavior part of the UEFI specification or is it EDK2-only? And
> what's the reasoning for it?
>
> Thanks,
> Bryan
> ___
> edk2-devel mailing list
> edk2-devel@lists.01.org
> https://lists.01.org/mailman/listinfo/edk2-devel
> ___
> edk2-devel mailing list
> edk2-devel@lists.01.org
> https://lists.01.org/mailman/listinfo/edk2-devel
>
___
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel
Re: [edk2] Why does EDK2 disable time checks on certificates?
Bryan:
You can reference EFI_CERT_X509_SHA256, EFI_CERT_X509_SHA384,
EFI_CERT_X509_SHA512 data structure definition in UEFI spec.
Now they are only supported in DBX. Revocation time here is defined by user
instead of directly from Validity of X059 Certificate in order to address the
issue mentioned below.
-Original Message-
From: edk2-devel [mailto:edk2-devel-boun...@lists.01.org] On Behalf Of Long, Qin
Sent: Tuesday, February 6, 2018 8:55 AM
To: Bryan Rosario <b...@google.com>; edk2-devel@lists.01.org
Subject: Re: [edk2] Why does EDK2 disable time checks on certificates?
It's EDK2-only.
The current pre-boot environment have no trusted timer synchronization service.
And it's very likely the system time is not the real-time (esp under dev
environment). So the certificate time expiration checking was bypassed to avoid
any boot break.
Against the corresponding certificate revocation case, the UEFI introduced the
DBX database (forbidden list) to address this.
Best Regards & Thanks,
LONG, Qin
-Original Message-
From: edk2-devel [mailto:edk2-devel-boun...@lists.01.org] On Behalf Of Bryan
Rosario
Sent: Tuesday, February 6, 2018 5:52 AM
To: edk2-devel@lists.01.org
Subject: [edk2] Why does EDK2 disable time checks on certificates?
See here ("Currently certificate time expiration checking is ignored."):
https://github.com/tianocore/tianocore.github.io/wiki/How-to-Enable-Security
.
Is this behavior part of the UEFI specification or is it EDK2-only? And what's
the reasoning for it?
Thanks,
Bryan
___
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel
___
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel
___
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel
Re: [edk2] Why does EDK2 disable time checks on certificates?
It's EDK2-only.
The current pre-boot environment have no trusted timer synchronization service.
And it's very likely the system time is not the real-time (esp under dev
environment). So the certificate time expiration checking was bypassed to avoid
any boot break.
Against the corresponding certificate revocation case, the UEFI introduced the
DBX database (forbidden list) to address this.
Best Regards & Thanks,
LONG, Qin
-Original Message-
From: edk2-devel [mailto:edk2-devel-boun...@lists.01.org] On Behalf Of Bryan
Rosario
Sent: Tuesday, February 6, 2018 5:52 AM
To: edk2-devel@lists.01.org
Subject: [edk2] Why does EDK2 disable time checks on certificates?
See here ("Currently certificate time expiration checking is ignored."):
https://github.com/tianocore/tianocore.github.io/wiki/How-to-Enable-Security
.
Is this behavior part of the UEFI specification or is it EDK2-only? And what's
the reasoning for it?
Thanks,
Bryan
___
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel
___
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel
[edk2] Why does EDK2 disable time checks on certificates?
See here ("Currently certificate time expiration checking is ignored."):
https://github.com/tianocore/tianocore.github.io/wiki/How-to-Enable-Security
.
Is this behavior part of the UEFI specification or is it EDK2-only? And
what's the reasoning for it?
Thanks,
Bryan
___
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel
