Thoughts dereferenced from the scratchpad noise.

Published at January 31, 2023 · Michał Żygowski · 14 min read

Qubes OS Anti Evil Maid (AEM) software heavily depends on the availability of the DRTM technologies to prevent the Evil Maid attacks. However, the project has not evolved much since the beginning of 2018 and froze on the support of TPM 1.2 with Intel TXT in legacy boot mode (BIOS). In the post we show how existing solution can be replaced with TrenchBoot and how one can install it on the Qubes OS. Also the post will also briefly explain how TrenchBoot opens the door for future TPM 2.0 and UEFI support for AEM....

Categories: bootloader firmware hypervisor os-dev security

Proof of concept implementation of RATS attestation for the TrenchBoot

Published at December 14, 2020 · Norbert Kamiński · 9 min read

This blog post will describe the concept of the IETF Remote Attestation Procedures (RATS) and implementation of CHAllenge-Response based Remote Attestation (CHARRA) with TPM 2.0 for TrenchBoot....

Categories: firmware security

GRUB mini–summit 2020

Published at November 2, 2020 · Kamila Banecka · 5 min read

GRUB mini–summit 2020. This year we cannot miss this opportunity to meet again and face the new challenges of GRUB/GRUB2. So,dear reader, feel invited to look at GRUB with a magnifying glass....

Categories: firmware os-dev security

Trenchboot: Xen hypervisor support for the TrenchBoot

Published at October 15, 2020 · Norbert Kamiński · Marek Kasiewicz · 4 min read

In this blog post, we will describe the development of the Xen hypervisor support for TrenchBoot....

Categories: firmware security

TrenchBoot: Open Source DRTM. Multiboot2 support.

Published at September 7, 2020 · Krystian Hebel · 11 min read

This month we will show that not only Linux kernel can be started by TrenchBoot. We also did some drastic changes to the bootloader data format, so if you try to redo some older posts in the future and they do not seem to work, this is probably the place to look for hints....

Categories: firmware security

3mdeb contribution 2020'Q2

Published at September 3, 2020 · Kamila Banecka · 4 min read

The second post on 3mdeb contribution summary! The second quarter of 2020 has brought new merged patches. Check the samples of code that we succesfully contributed and feel free to use them in your own projects....

Categories: miscellaneous

TrenchBoot: Open Source DRTM. TPM event log all the way.

Published at August 13, 2020 · Krystian Hebel · 12 min read

We extended the TPM event log support to the Linux kernel. It is now possible to print all of the PCR extend operations performed and compare the hashes with files to see if anything is wrong....

Categories: firmware security

DEV and IOMMU: a story of two DMA protection mechanisms

Published at July 3, 2020 · Krystian Hebel · 12 min read

Both DEV and IOMMU can help with protection against malicious DMA. This post roughly describes the difference between those two, as well as the impact they have on each other in the context of TrenchBoot...

Categories: firmware security

TrenchBoot: Open Source DRTM. GRUB's new features and TPM event log.

Published at July 3, 2020 · Piotr Kleinschmidt · 17 min read

This blog post will show you what features we have added to GRUB and why they are useful from user's point of view. Also, there will be shown how to utilize TPM event logs and hence debug DRTM....

Categories: firmware security

Starting TrenchBoot's Landing Zone from iPXE

Published at June 1, 2020 · Krystian Hebel · 10 min read

In this article we present support for starting Landing Zone from another bootloader: iPXE. It may not be as featureful as GRUB2, but it has enough juice to start DRTM using images obtained from a remote server...

Categories: firmware security

Installing TrenchBoot in UEFI environments

Published at May 6, 2020 · Michał Żygowski · 17 min read

This blog post will show you how to install NixOS on UEFI platforms and how to install TrenchBoot on them....

Categories: firmware os-dev security

TrenchBoot: Open Source DRTM. CI/CD system.

Published at May 5, 2020 · Piotr Kleinschmidt · 6 min read

How to improve development and validation process in our project? Automation? Of course! Let us introduce our CI/CD system. Find out how it actually works and what advantages it has....

Categories: firmware security

TrenchBoot: Open Source DRTM. DRTM update and meta-trenchboot implementation

Published at April 30, 2020 · Piotr Kleinschmidt · 11 min read

Another release brings new updates in our Open Source DRTM project. Except for code changes, we have prepared our custom Linux image with DRTM. Also we set up CI/CD system for automation build and test. Read this article if you want to find out more details....

Categories: firmware security

TrenchBoot: Open Source DRTM. Landing Zone validation.

Published at April 3, 2020 · Piotr Kleinschmidt · 25 min read

When you already know what is TrenchBoot, what is DRTM and how we enable it on AMD processors, we can move on to practice. I will show you how to configure all components and verify first of project's requirements....

Categories: firmware security

TrenchBoot - Open Source DRTM for AMD processors. Project's basics.

Published at March 31, 2020 · Piotr Kleinschmidt · 11 min read

This is the first blog post of TrenchBoot series. It will introduce you to the project, its structure and environment. Additionally the reader will find out more about each component, how to setup the environment and configure the build....

Categories: firmware security

Open Source DRTM with TrenchBoot for AMD processors. Introduction.

Published at March 28, 2020 · Piotr Kleinschmidt · 4 min read

This article starts an entire series of articles related to title project. By reading this blog post, you will find out why we have started such project and who is supporting us. Also, we bring you closer to main concept and goals....

Categories: firmware security

GRUB2 and 3mdeb minisummit 2019

Published at February 19, 2020 · Piotr Król · 7 min read

In December 2019 we had pleasure to meet Daniel Kiper #GRUB2 maintanaer in 3mdeb office in Gdańsk. We dicussed various #GRUB2, #Xen, #firmware, #coreboot, #security and #TPM related topics. Results of that "minisummit" was presented in following blog post in form of presentations and videos....

Categories: firmware os-dev security

#trenchboot

Donate

Search

Recent posts

TrenchBoot Anti Evil Maid for Qubes OS

3mdeb Insights - Winter 2023

Qubes OS summit 2022 - Summary

Infrastructure for Xen development and debugging

Minimal OS for Fobnail

Top authors

Archives

Popular tags