vathpela/efitools

tpm support with efitools

Closed this issue · 1 comments

shridharcs commented

/usr/bin/cert-to-efi-sig-list

The above is from,
efitools-1.9.2-1.

For secure boot of machine, it is necessary to load the EFI dbs i.e. PK, KEK and allowed database.
For loading PK for example, first the cert needs to be converted into esl
#cert-to-efi-sig-list -g "$(uuidgen)" PK.crt PK.esl

and then self sign in case of PK.
#sign-efi-sig-list -k PK.key -c PK.crt PK PK.esl PK.auth

and update PK db later with,
#efi-updatevar -f PK.auth PK

So, in this case second step i.e. sign-efi-sig-list needs private key in plain text format.

But if the key has to be retrieved from TPM, in that case it shall be retrieved as encrypted key.

Does efitools support reading key from TPM? Was there any such request? can that enhancement be done?

For secure boot the below page can be referred for more infromation.
https://wiki.gentoo.org/wiki/User:Sakaki/Sakaki%27s_EFI_Install_Guide/Configuring_Secure_Boot