Messages in this thread | | | Date | Tue, 19 Mar 2013 18:28:10 +0000 | From | Matthew Garrett <> | Subject | Re: [PATCH] x86/efi: pull NV+BS variables out before we exit boot services |
| |
On Tue, Mar 19, 2013 at 06:23:31PM +0000, James Bottomley wrote:
> The scheme we discussed, unless something radically changed, was to > convey a temporary key pair via a mechanism to later verify the > hybernate kernel on a resume. That only requires reboot safe knowledge > of the public key. The private key can be conveyed in BS only (not NV), > and should be consumed (as in deleted) by the OS when it receives it, so > it wouldn't be exposed by this patch.
It requires the key to survive the system being entirely powered down, which means it needs to be BS+NV. It shouldn't be possible for userspace to access this key.
-- Matthew Garrett | mjg59@srcf.ucam.org
| |