search

Foxboron / sbctl

:computer: :lock: :key: Secure Boot key manager
MIT License
1.51k stars 87 forks source link

Rotating specific key(s) #249

Closed Quant-ux closed 4 months ago

Quant-ux commented 1 year ago

One of downsides of storing keys locally is the fact an adversary with root privileges can sign and install bootkits. My solution is to this is to store PK and KEK offline, and db on the host's drive. Obviously,db remains unprotected here but if the system gets compromised, only db is affected.

If I'm correct, the EFI signing command rotate-keys is used to rotate all keys so it can't be used to replace a single key. With this in mind, considering my use case, I think the ability to selectively rotate keys would be beneficial.

Foxboron commented 1 year ago

This is implemented in master but hasn't been part of a release yet.

https://github.com/Foxboron/sbctl/pull/236/commits/889325e5ea5fb076ff8f47604f20936106249cb6

I can do a release this weekend probably.

Foxboron commented 1 year ago

I still plan to rework the key storage code so in the future keys can be stored on yubikeys, TPMS or PKCS11 devices. That should remove a lot of the issue with having keys available on the system.