Along the lines of Android Nougat's strictly enforced verified boot and Windows' Secure Boot features, Qualcomm is also pursuing a set of security standards based on cryptographic image authentication to ensure a secure boot chain.
A typical secure boot chain. (Qualcomm, Ryan Nakamoto)
As Qualcomm Engineer Ryan Nakamoto muses, all devices with boot chains are potentially vulnerable to malicious image injection. If an attacker gains access to images earlier in the boot chain, particularly the primary or secondary bootloaders, they gain the ability to control much or all of what follows. In order to better prevent attacks like these, Qualcomm's implementation of secure boot secures every aspect of the boot chain, beginning with the first ROM bootloader. As a step of the chain finishes, the segment will verify that it is unmodified and then provide a signature that the next segment in the boot chain must cryptographically verify. If the signature produced is different than what the following segment expects, then the boot process will be immediately ended.
While secure boot implementations like dm-verity and Windows Secure Boot are the bane of many a custom ROM developers, the improved security they offer the lay-consumer is paramount.
As Microsoft and Qualcomm recently announced that upcoming devices would be able to run Windows 10 on Snapdragon hardware this year, it is far from surprising that Qualcomm chose to bring up its secure boot implementation in late 2016. Given the spate of Android security scares that arose throughout 2016, security has become a serious concern for many consumers, so Qualcomm's continued dedicated to secure software is more than welcome.
Source: Qualcomm
from xda-developers http://ift.tt/2k18iWL
via IFTTT
No comments:
Post a Comment