Are there two different Key Manifests?

[Jon-xelex]

I recently start develop BIOS for the new Tiger Lake CPU. I want to enable Intel Boot Guard technology to make platform much more secure, but I encounter one concept that baffle me in Boot Guard: Key Manifest.

I reference Intel® Converged Boot Guard and Intel® Trusted ExecutionTechnology (Intel® TXT) (doc no 575623) document and it mentions a concept called Key Manifest, which stores hashed public key to verify Boot Policy Manifest components. Then I reference Tiger Lake and Rocket Lake Signing and Manifesting Guide for a clue about how signature work and how to make one. I encountered concept Key Manifest again in Tiger Lake and Rocket Lake Signing and Manifesting Guide (interestingly, this Key Manifest is called OEM Key Manifest), which contains hashed public key for firmware component (ISH, OS BootLoader, iUnit, Audio, ME...). Moreover, I compared structure of Key Manifest between two mentioned documents and they are different!

I want to know if there are actually two different Key Manifests for two different purposes:

- One for Intel Boot Guard (Key Manifest -> Boot Policy Manifest -> Initial Boot Block)

- One for verify firmware components (Key Manifest -> Firmware components). This Key Manifest is also called OEM Key Manifest

Beside, I'd like to know if it happens that there are two different Key Manifest, are their signature's public key come from same Field Programmable Fuses (FPF)?

Thank you!

[Jon-xelex]

I recently start develop BIOS for the new Tiger Lake CPU. I want to enable Intel Boot Guard technology to make platform much more secure, but I encounter one concept that baffle me in Boot Guard: Key Manifest.

I reference Intel® Converged Boot Guard and Intel® Trusted ExecutionTechnology (Intel® TXT) (doc no 575623) document and it mentions a concept called Key Manifest, which stores hashed public key to verify Boot Policy Manifest components. Then I reference Tiger Lake and Rocket Lake Signing and Manifesting Guide for a clue about how signature work and how to make one. I encountered concept Key Manifest again in Tiger Lake and Rocket Lake Signing and Manifesting Guide (interestingly, this Key Manifest is called OEM Key Manifest), which contains hashed public key for firmware component (ISH, OS BootLoader, iUnit, Audio, ME...). Moreover, I compared structure of Key Manifest between two mentioned documents and they are different!

I want to know if there are actually two different Key Manifests for two different purposes:

- One for Intel Boot Guard (Key Manifest -> Boot Policy Manifest -> Initial Boot Block)

- One for verify firmware components (Key Manifest -> Firmware components). This Key Manifest is also called OEM Key Manifest

Beside, I'd like to know if it happens that there are two different Key Manifest, are their signature's public key come from same Field Programmable Fuses (FPF)?

Thank you!

[JoseH_Intel]

Hello Jon-xelex,

Thank you for joining the Intel community

Please allow us a bit of time in order to research on your question. We will get back to you soon.

Regards

Jose A.

Intel Customer Support Technician

For firmware updates and troubleshooting tips, visit:

https://intel.com/support/serverbios

[Alberto_Sykes]

Jon-xelex, Thank you for posting in the Intel® Communities Support.

In order for us to be able to provide the most accurate support on this matter, please visit, sign-in and submit your inquiry in our Intel® Developer Zone site, they will further assist you with this topic ion there:

https://software.intel.com/content/www/us/en/develop/home.html

Regards,

Albert R.

Intel Customer Support Technician