• About
• Latest Posts

Purism

Beautiful, Secure, Privacy-Respecting Laptops, Tablets, PCs, and Phones

Latest posts by Purism (see all)

• PureOS Crimson Development Report: October 2024 - November 14, 2024
• PureOS Crimson Development Report: September 2024 - October 16, 2024
• Quantum Safe Communication with Purism - September 23, 2024

PureBoot is our high-security boot firmware we offer on our Librem computers. In combination with a Librem Key, PureBoot allows you to detect tampering in the boot firmware itself, and in your OS’s kernel and other boot files.

It detects tampering first by sending measurements of the boot firmware as it boots (containing among other things a trusted GPG keyring corresponding to keys on your Librem Key) at boot time to the computer’s TPM, and if the measurements match, the TPM releases a shared secret that PureBoot converts to a 6-digit HOTP code and sends to the Librem Key. If the code matches what the Librem Key itself generated, the Librem Key blinks green, letting you know the firmware can be trusted. If it doesn’t match, the Librem Key will blink a steady red LED indefinitely, warning you the firmware might be tampered with.

Once the firmware is trusted, PureBoot then will automatically attempt to boot your system. It tests all of the files in the /boot directory against their previously-trusted signatures and if they match, it will automatically boot, otherwise it will alert you to the issue. This verification doesn’t use the TPM, but instead uses GPG signatures in the /boot directory.

The Security Flaw

Our initial releases of PureBoot for the Librem 14 (and only the Librem 14), contained a simple but serious flaw: the measured_boot option was disabled in coreboot, the free software boot firmware that we use to load PureBoot. As a result, measurements weren’t being stored in the TPM yet PureBoot itself was able to communicate with the Librem Key and the Librem Key would report that the boot firmware was OK. This means that if the boot firmware were changed on the Librem 14, PureBoot wouldn’t have detected it. Because this failure was silent, it took some time to detect it. This security flaw only affected tamper detection on the boot firmware, PureBoot would still detect any changes in files in /boot as that relies on the GPG keys on the Librem Key, not the TPM.

All Librem 14 PureBoot users should upgrade to version 18.1 immediately. This release enables measured_boot and will restore boot firmware tamper detection like in PureBoot releases for other Librem computers. To update PureBoot, follow the steps in our official PureBoot documentation to download the latest PureBoot ROM, or otherwise you can download the Librem 14 PureBoot release directly from here. We understand and appreciate the severity of an issue like this and are tightening up our process to ensure something like this doesn’t happen again.