Re: Why does EDK2 disable time checks on certificates?

["Zhang, Chao B" <chao.b.zhang@intel.com>]

Bryan:    
       You can reference EFI_CERT_X509_SHA256,  EFI_CERT_X509_SHA384, EFI_CERT_X509_SHA512 data structure definition in UEFI spec.
  Now they are only supported in DBX.  Revocation time here is defined by user instead of directly from Validity of X059 Certificate in order to address the issue mentioned below.
        

-----Original Message-----
From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of Long, Qin
Sent: Tuesday, February 6, 2018 8:55 AM
To: Bryan Rosario <bcr@google.com>; edk2-devel@lists.01.org
Subject: Re: [edk2] Why does EDK2 disable time checks on certificates?

It's EDK2-only. 
The current pre-boot environment have no trusted timer synchronization service. And it's very likely the system time is not the real-time (esp under dev environment). So the certificate time expiration checking was bypassed to avoid any boot break. 

Against the corresponding certificate revocation case, the UEFI introduced the DBX database (forbidden list) to address this. 


Best Regards & Thanks,
LONG, Qin

-----Original Message-----
From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of Bryan Rosario
Sent: Tuesday, February 6, 2018 5:52 AM
To: edk2-devel@lists.01.org
Subject: [edk2] Why does EDK2 disable time checks on certificates?

See here ("Currently certificate time expiration checking is ignored."):
https://github.com/tianocore/tianocore.github.io/wiki/How-to-Enable-Security
.

Is this behavior part of the UEFI specification or is it EDK2-only? And what's the reasoning for it?

Thanks,
Bryan
_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel
_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel