Investigate coreboot hashing -> TPM extend timings for additional tamper evidence proof (spkmodem?)
Had a crazy idea which is apparently not so new. We could introspect coreboot ticks per stages, and use it to improve tamper evidence.
- cbmem -T provides timestamps of each stages and substages of boot
- cbmem -c provides timestamps in logs, with ticks spent on each task, reported in cbmem -T
What if we modified coreboot to use spkmodem to report when regions are hashed, and time spent in each hashing? What if we "sang" this through spkmodem, through a seperate Kconfig to use spkmodem only to log those? We chould then have a proof that bootblock is hashing itself and next stages and so on with real time spent into hashing segments and tick count.
Just an idea I wanted written somwhere
0 条评论