search

riscv-non-isa / riscv-server-platform

The RISC-V Server Platform specification defines a standardized set of hardware and sofware capabilities, that portable system software, such as operating systems and hypervisors, can rely on being present in a RISC-V server platform.
https://jira.riscv.org/browse/RVC-6
Creative Commons Attribution 4.0 International
7 stars 2 forks source link

Questions about security requiremements #18

Open andreabolognani opened 1 week ago

andreabolognani commented 1 week ago

First, a simple clarification: the spec says

it is expected the high-level RoT / boot flow requirements

What is "RoT" in this context? I'm not familiar with the acronym and it's not defined in the glossary, nor was I able to quickly find an explanation online. It doesn't help that "rot" is a common word in the English language :)

More to the point, I see that SEC_010 mandates that UEFI Secure Boot is implemented. Is that actually feasible today?

I was recently discussing the RISC-V implementation of shim, which is a critical part of how Linux implements the Secure Boot trust chain, and a concern was raised that the necessary infrastructure/agreements might not be in place yet. Do we have additional information about that?

Or is the intention that the mechanisms for Secure Boot are implemented, with no expectation that Microsoft's (or anyone else's) key is actually enrolled out of the box? If so, would it be worth clarifying in the non-normative text?