On 02.02.21 14:56, Grant Likely wrote: > > > On 02/02/2021 12:48, Peter Robinson wrote: >> On Mon, Feb 1, 2021 at 8:28 PM Heinrich Schuchardt >> <[email protected]> wrote: >>> >>> On 2/1/21 8:56 PM, Grant Likely wrote: > [...] >>>> On 29/01/2021 20:17, Heinrich Schuchardt wrote: >>>>> On 1/29/21 8:21 PM, Grant Likely wrote: >>> >>> * - EFI_PXE_BASE_CODE_PROTOCOL >>> - Booting via the Preboot Execution Environment (PXE) is insecure. >>> Loading via PXE is typically executed before launching the first >>> UEFI application. >> >> I don't think PXE should be a requirement, as Heinrich mentions it's >> insecure. We should be requiring a secure protocol for a new spec, not >> an old one that's being EOLed. I believe vendors are moving to remove >> it in favour of HTTPS boot which also has the advantage it's more >> flexible, and it much better places for IoT/Edge deployments which use >> CDNs and the life extensively and it will generally work with >> firewalls etc. If we're going to require something for network >> installs, if the device has a capable network interface, it should be >> HTTPS Boot. >> >> Peter > > Unfortunately we've got a functionality gap. U-Boot doesn't yet support > TCP, HTTP, or TLS. All that functionality needs to be written or ported > from somewhere. > > I would really like to require a secure network boot mechanism, but I > think it needs to be left out until U-Boot can do TCP and TLS.
You can use iPXE as U-Boot payload which offers HTTPS and iSCSI. Isn't that enough? TLS is quite complicated. GNU TLS has > 430,000 lines of code (without comments). Looking at the number of CVEs in OpenSSL and GnuTLS I do not believe that the U-Boot community will be able to produce and maintain a secure implementation. There have been multiple attempts to get TCP into U-Boot but all got stuck but I think that TCP should be feasible. The major obstacle with network in U-Boot is that we are running single threaded without interrupts. Best regards Heinrich _______________________________________________ boot-architecture mailing list [email protected] https://lists.linaro.org/mailman/listinfo/boot-architecture
