- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I recently start develop BIOS for the new Tiger Lake CPU. I want to enable Intel Boot Guard technology to make platform much more secure, but I encounter one concept that baffle me in Boot Guard: Key Manifest.
I reference Intel® Converged Boot Guard and Intel® Trusted ExecutionTechnology (Intel® TXT) (doc no 575623) document and it mentions a concept called Key Manifest, which stores hashed public key to verify Boot Policy Manifest components. Then I reference Tiger Lake and Rocket Lake Signing and Manifesting Guide for a clue about how signature work and how to make one. I encountered concept Key Manifest again in Tiger Lake and Rocket Lake Signing and Manifesting Guide (interestingly, this Key Manifest is called OEM Key Manifest), which contains hashed public key for firmware component (ISH, OS BootLoader, iUnit, Audio, ME...). Moreover, I compared structure of Key Manifest between two mentioned documents and they are different!
I want to know if there are actually two different Key Manifests for two different purposes:
- One for Intel Boot Guard (Key Manifest -> Boot Policy Manifest -> Initial Boot Block)
- One for verify firmware components (Key Manifest -> Firmware components). This Key Manifest is also called OEM Key Manifest
Beside, I'd like to know if it happens that there are two different Key Manifest, are their signature's public key come from same Field Programmable Fuses (FPF)?
Thank you!
Link Copied
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello Jon-xelex,
Thank you for joining the Intel community
Please allow us a bit of time in order to research on your question. We will get back to you soon.
Regards
Jose A.
Intel Customer Support Technician
For firmware updates and troubleshooting tips, visit:
https://intel.com/support/serverbios
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Jon-xelex, Thank you for posting in the Intel® Communities Support.
In order for us to be able to provide the most accurate support on this matter, please visit, sign-in and submit your inquiry in our Intel® Developer Zone site, they will further assist you with this topic ion there:
https://software.intel.com/content/www/us/en/develop/home.html
Regards,
Albert R.
Intel Customer Support Technician
![](/skins/images/D2683F18326913BBA0436CB7114DD569/responsive_peak/images/icon_anonymous_message.png)
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page