Verified boot and free software: reconciling freedom and security
Description
A growing number of modern computers, whether they’re traditional x86 desktops and laptops or embedded devices ship with some form of verified boot mechanism. In practice, it often means that only bootup software allowed by the manufacturer can run on those computers, causing great harm to freedom, but also to security. Using asymmetrical cryptographic algorithms for signing these binaries with a private key kept secret by the manufacturer and a public key often stored in read-only memory, it becomes impossible for end users to build, install and run free bootup software on their devices.
However, there are a few examples of devices on which verified boot is implemented in a way that allows end users to stay in control of their devices. Namely, Chrome/Chromium OS (CrOS) devices such as Chromebooks implement reliable verified boot in a way that doesn’t conflict with software freedom, on purpose. Taking things up a notch, verified boot is implemented with free software, both at the bootup software and embedded controller firmware levels.
Paul Kocialkowski
Paul Kocialkowski started using free software in 2008 and soon gained interest in software freedom, with a particular emphasis on running fully free software. After breaking his Openmoko FreeRunner, he took at shot at Replicant, the fully free version of Android. He soon became involved in active development and has been the lead developer of the project since 2012.
Driven by a growing interest in embedded devices, he took charge of the single board computers and plug computers freedom comparisons on the Free Software Foundation’s website. Recently, he’s been working on freeing mobile and embedded devices at the lower levels, contributing to the U-Boot, Flashrom, Coreboot, Libreboot and Linux projects.
