Re: Why does EDK2 disable time checks on certificates?

["Long, Qin" <qin.long@intel.com>]

The OS can update the certificates by correct SetVariable() call with authenticated payload (following UEFI secure boot / authenticated variable definitions. Refer to the section 8.2  "Variable Services" and chapter 31 "Secure Boot and Driver Signing" for more details). 
I am not sure if current OS will enforce any periodical update. Currently, UEFI is just distributing the revocation list file to address possible security risks (http://www.uefi.org/revocationlistfile). 


Best Regards & Thanks,
LONG, Qin

-----Original Message-----
From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of Bryan Rosario
Sent: Tuesday, February 6, 2018 10:17 AM
To: Zhang, Chao B <chao.b.zhang@intel.com>
Cc: edk2-devel@lists.01.org; Alain Gefflaut <alaingef@google.com>; Long, Qin <qin.long@intel.com>
Subject: Re: [edk2] Why does EDK2 disable time checks on certificates?

Thanks for the info.

Another question: if I enable time checks in my local copy of EDK2 (or if there is another UEFI implementation with time checks enabled), do operating systems generally update their certificates periodically to avoid them expiring?
In particular, I'm wondering about bootloaders that are signed for secure boot. I've seen expiration times on the attached certificates and I'm wondering if the bootloader will be periodically updated, or if operating systems will just expect that the firmware doesn't actually enforce the expiration time.

On Mon, Feb 5, 2018 at 5:45 PM, Zhang, Chao B <chao.b.zhang@intel.com>
wrote:

> Bryan:
>        You can reference EFI_CERT_X509_SHA256,  EFI_CERT_X509_SHA384,
> EFI_CERT_X509_SHA512 data structure definition in UEFI spec.
>   Now they are only supported in DBX.  Revocation time here is defined 
> by user instead of directly from Validity of X059 Certificate in order 
> to address the issue mentioned below.
>
>
> -----Original Message-----
> From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of 
> Long, Qin
> Sent: Tuesday, February 6, 2018 8:55 AM
> To: Bryan Rosario <bcr@google.com>; edk2-devel@lists.01.org
> Subject: Re: [edk2] Why does EDK2 disable time checks on certificates?
>
> It's EDK2-only.
> The current pre-boot environment have no trusted timer synchronization 
> service. And it's very likely the system time is not the real-time 
> (esp under dev environment). So the certificate time expiration 
> checking was bypassed to avoid any boot break.
>
> Against the corresponding certificate revocation case, the UEFI 
> introduced the DBX database (forbidden list) to address this.
>
>
> Best Regards & Thanks,
> LONG, Qin
>
> -----Original Message-----
> From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of 
> Bryan Rosario
> Sent: Tuesday, February 6, 2018 5:52 AM
> To: edk2-devel@lists.01.org
> Subject: [edk2] Why does EDK2 disable time checks on certificates?
>
> See here ("Currently certificate time expiration checking is ignored."):
> https://github.com/tianocore/tianocore.github.io/wiki/How-
> to-Enable-Security
> .
>
> Is this behavior part of the UEFI specification or is it EDK2-only? 
> And what's the reasoning for it?
>
> Thanks,
> Bryan
> _______________________________________________
> edk2-devel mailing list
> edk2-devel@lists.01.org
> https://lists.01.org/mailman/listinfo/edk2-devel
> _______________________________________________
> edk2-devel mailing list
> edk2-devel@lists.01.org
> https://lists.01.org/mailman/listinfo/edk2-devel
>
_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel