Linux Security Summit Europe 2020

Intel TXT is a D-RTM technology that allows to set-up trusted environment by measuring boot process components. Measurements, stored in TPM, can be verified by local or remote attestation to detect any inconsistency in the boot process. UEFI Secure Boot has a similar goal, however, it is achieved in different ways. In opposite to Intel TXT, Secure Boot is an S-RTM technology that requires to maintain trusted chain from the beginning of system power up. TBOOT is an implementation of MLE in Intel TXT dedicated for Linux kernel based OS and Xen VMM. The current version does not support Secure Boot, so there is no possibility to enable Intel TXT and Secure Boot simultaneously when using TBOOT. This presentation discusses the possibilities of enabling Secure Boot in TBOOT and what benefits come from that.