\subsection{Introduction}

\begin{frame}[fragile]{Who wants to verify the boot sequence and why?}
\begin{itemize}
  \item product vendors
  \begin{itemize}
    \item make sure your devices are used the way they should be
    \item not for a different purpose
    \item not for running unapproved software (e.g. software limitations
    removed)
    \item protect your consumers
  \end{itemize}
  \item end users
  \begin{itemize}
    \item make sure your system hasn't been tampered with
  \end{itemize}
  \item basically, to make sure the binaries you're trying to
  load/boot/execute were built by a trustworthy person
\end{itemize}
\end{frame}

\begin{frame}[fragile]{How does it work?}
\begin{itemize}
  \item everything is based on digital signature verification ($\neq$
  encryption)
  \item the first element in the boot process authenticates the
  second, the second the third, etc...
  \item called a chain-of-trust: if any element is authenticated but
  not sufficiently locked-down (e.g. console access in bootloader,
  root access in userspace), the device is not verified anymore
\end{itemize}
\end{frame}

\begin{frame}[fragile]{What does a chain-of-trust look like?}
  \includegraphics[width=1\textwidth]{drawings/01_chain-of-trust.pdf}
  \hspace{1cm}
  \begin{itemize}
  \item every component is verified using its digital signature and a
  public key
  \item the rootfs integrity is verified using a hash mechanism
  \item our experience:
    \begin{itemize}
    \item implemented chain-of-trust on custom i.MX6 boards
    \item Quentin worked on the chain-of-trust from ROM code up
      to the kernel
    \item Mylène worked on the root FS part of the chain-of-trust
    \end{itemize}
  \end{itemize}
\end{frame}

\begin{frame}[fragile]{Mandatory Alice and Bob example: encryption}
\includegraphics[width=\linewidth]{drawings/encryption.pdf}
\begin{itemize}
  \item provided Bob's public key is publicly available
  \textbf{anyone} (Alice, Charles, David, etc.) can send
  \textbf{encrypted data} to someone (Bob) that is the \textbf{only
  one} able to decrypt it
\end{itemize}
\end{frame}

\begin{frame}[fragile]{Mandatory Alice and Bob example: signature}
\includegraphics[width=\linewidth]{drawings/signing.pdf}
\begin{itemize}
  \item provided Alice's public key is publicly available,
  \textbf{anyone} (Bob, Charles, David, etc.) can verify that the
  \textbf{signed data} someone sent them is sent by the \textbf{only
    one} (Alice) able to sign it
\end{itemize}
\end{frame}

\begin{frame}[fragile]{Not inconsequential}
\begin{itemize}
\item costly in terms of:
\begin{itemize}
 \item logistic and overall project complexity: whole architecture to
 create keys, build with the keys, ...
 \item workflow complexity for developers: if the platform is locked
 down, need to re-sign the binary every time and validate the
 chain-of-trust
 \item boot time (bunch of authentications to be made
 along the way to Linux prompt)
 \end{itemize}
 \item you have to be extremely careful with your chain-of-trust and
 private keys so that none is broken or leaked
 \end{itemize}
\end{frame}