BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

3.5.1 Authenticated Update Mechanism

NIST platform security: roots of trust, firmware and secure enclaves SP 800-193
All changes in this version
first version loaded 3 Principles and Key Concepts part of 3.5

Title

Authenticated Update Mechanism

Control

An authenticated update mechanism employs digital signatures to ensure the authenticity of the firmware update image. An update of the firmware image using an authenticated update mechanism relies on a Root of Trust for Update (RTU) that contains a signature verification algorithm and a key store that includes the public key needed to verify the signature on the firmware update image. The key store and the signature verification algorithm are stored in a protected fashion on the computer system and are modifiable only through use of an authenticated update mechanism or a secure local update mechanism.

The key store in the RTU includes a public key used to verify the signature [7] on a firmware update image or includes a hash [6] of the public key if a copy of the public key is provided with the firmware update image. In the latter case, the update mechanism hashes the public key provided with the firmware update image and ensures that it matches a hash which appears in the key store before using the provided public key to verify the signature on the firmware update image.

It is possible that the private key corresponding to the public key in the key store may become “compromised”, for example, by the private key being stolen and exposed. An attacker that gains access to this key could sign invalid firmware that might damage platform devices or inject malware into the platform. Proper use of signatures thus necessitates provisions to recover from a key compromise. A variety of techniques may be used to recover from these situations. Examples range from the complex, including key hierarchies, to simpler, including updating the key store when recovering (or updating) the rest of an image.