Had a crazy idea which is apparently not so new. We could introspect coreboot ticks per stages, and use it to improve tamper evidence.
- cbmem -T provides timestamps of each stages and substages of boot
- cbmem -c provides timestamps in logs, with ticks spent on each task, reported in cbmem -T
What if we modified coreboot to use spkmodem to report when regions are hashed, and time spent in each hashing? What if we "sang" this through spkmodem, through a seperate Kconfig to use spkmodem only to log those? We chould then have a proof that bootblock is hashing itself and next stages and so on with real time spent into hashing segments and tick count.
Just an idea I wanted written somwhere
Had a crazy idea which is apparently not so new. We could introspect coreboot ticks per stages, and use it to improve tamper evidence.
What if we modified coreboot to use spkmodem to report when regions are hashed, and time spent in each hashing? What if we "sang" this through spkmodem, through a seperate Kconfig to use spkmodem only to log those? We chould then have a proof that bootblock is hashing itself and next stages and so on with real time spent into hashing segments and tick count.
Just an idea I wanted written somwhere