From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with archive (Exim 4.43) id 1LasBT-0006Ll-1f for mharc-grub-devel@gnu.org; Sat, 21 Feb 2009 08:46:23 -0500 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1LasBO-0006Ku-Dj for grub-devel@gnu.org; Sat, 21 Feb 2009 08:46:18 -0500 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1LasBM-0006KQ-SI for grub-devel@gnu.org; Sat, 21 Feb 2009 08:46:17 -0500 Received: from [199.232.76.173] (port=48641 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1LasBM-0006KD-1G for grub-devel@gnu.org; Sat, 21 Feb 2009 08:46:16 -0500 Received: from aybabtu.com ([69.60.117.155]:46274) by monty-python.gnu.org with esmtps (TLS-1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.60) (envelope-from ) id 1LasBL-0006pp-KR for grub-devel@gnu.org; Sat, 21 Feb 2009 08:46:15 -0500 Received: from [192.168.10.10] (helo=thorin) by aybabtu.com with esmtp (Exim 4.69) (envelope-from ) id 1Las4k-00075B-8q; Sat, 21 Feb 2009 14:39:26 +0100 Received: from rmh by thorin with local (Exim 4.69) (envelope-from ) id 1LasBD-0004Gh-JO; Sat, 21 Feb 2009 14:46:07 +0100 Date: Sat, 21 Feb 2009 14:46:07 +0100 From: Robert Millan To: The development of GRUB 2 Message-ID: <20090221134607.GJ16068@thorin> References: <499DB343.9020301@gmail.com> <499DF97E.1080800@student.ethz.ch> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Organization: free as in freedom X-Message-Flag: Worried about Outlook viruses? Switch to Thunderbird! www.mozilla.com/thunderbird X-Debbugs-No-Ack: true User-Agent: Mutt/1.5.18 (2008-05-17) X-detected-operating-system: by monty-python.gnu.org: Genre and OS details not recognized. Cc: Alex Besogonov , Jan Alsenz Subject: Re: A _good_ and valid use for TPM X-BeenThere: grub-devel@gnu.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: The development of GRUB 2 List-Id: The development of GRUB 2 List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 21 Feb 2009 13:46:19 -0000 On Fri, Feb 20, 2009 at 03:03:04AM +0200, Alex Besogonov wrote: > On Fri, Feb 20, 2009 at 2:29 AM, Jan Alsenz wrote: > [skip] > > The TPM can proof to another party, that the PCRs have certain values (of > > course the communication needs to be established by normal software running on > > the machine) > Yes, I'm trying to do remote attestation. You're confusing things. I think you simply want to ensure data integrity, and the TPM doesn't even do that: it simply puts the problem in hands of a third party. "remote attestation" is only useful when you want to coerce others into running your (generaly proprietary) software. I hope this is not what you want to do. > >> First, I don't think it's possible to implement SHA-1 hashing in MBR - > >> there's probably just not enough space left in 512-byte code segment > >> for that. > > I am very sure of that. > Well, I spoke phcoder on Jabber - there might be a way to do this. > He's going to investigate it. This is unnecessary. Once GRUB supports crypto, it can simply load itself from an encrypted filesystem on disk. An image can be of arbitrary size. -- Robert Millan The DRM opt-in fallacy: "Your data belongs to us. We will decide when (and how) you may access your data; but nobody's threatening your freedom: we still allow you to remove your data and not access it at all."