Hacker News Reader

1996

> Even then there is no way to authenticate what you are booting.

Let me introduce you to TPM, signed binaries and measured boot!

However, the most secure ways usually involve a flashed kernel (coreboot) on a write protected NAND chip, of course with encrypted root, that start the boot process by dumping and sha'ing the NAND and comparing that to the whitelist.

View on HN

TPM usage assumes Secure Boot though. It's fairly useless if you are booting malicious files.

With enrolled keys and a password protected bios that refuses to add boot options to the boot menu, and refuse to boot existing options if the signature no longer matches, you can't be booting malicious files.

And that is what Secure Boot does for you. Not the TPM.

And to do that, a TPM is needed to keep the keys/signatures

Reply on news.ycombinator.com