TrenchBoot - DRTM launch between coreboot and UEFI payload
Protect coreboot payload with dynamic Roots of Trust
This project will enhance the security of Qubes OS by integrating the TrenchBoot Project with the Anti Evil Maid (AEM) implementation. AEM isn't the only use for DRTM: a dynamically started chain of trust can also be used to improve the security of systems on which protections starting at or before reset vector aren't feasible. This allows the UEFI verification mechanism known as Secure Boot to be transitively rooted in hardware through RTM, without depending on proprietary, usually one-time solutions like Intel Boot Guard. Through comprehensive hardware testing, the successful execution of this initiative will promote the adoption of DRTM technology in open-source and security-oriented operating systems, ensuring enhanced security for Qubes OS. Part of the project will focus on performing DRTM between coreboot and its payload - edk2. The project will prioritize stability, testing, and ensuring the reproducibility of results for broader community adoption.
- The project's own website: https://trenchboot.org
Run by 3mdeb Sp. z o.o.
This project was funded through the NGI0 Commons Fund, a fund established by NLnet with financial support from the European Commission's Next Generation Internet programme, under the aegis of DG Communications Networks, Content and Technology under grant agreement No 101135429. Additional funding is made available by the Swiss State Secretariat for Education, Research and Innovation (SERI).
