• About
• Latest Posts

Kyle Rankin

PGP ID: 0xB9EF770D6EFE360F
Fingerprint: 0DFE 2A03 7FEF B6BF C56F73C5 B9EF 770D 6EFE 360F
Librem Social

Latest posts by Kyle Rankin (see all)

• Bootstrapping Trust with Anti-Interdiction - March 22, 2023
• Where is My Librem 5? Part 3 - March 8, 2023
• My Top 10 Lapdock Kit Tips - February 27, 2023

PureBoot is our high-security boot firmware we offer on our Librem computers. In combination with a Librem Key, PureBoot allows you to detect tampering in the boot firmware itself, and in your OS’s kernel and other boot files.

It detects tampering first by sending measurements of the boot firmware as it boots (containing among other things a trusted GPG keyring corresponding to keys on your Librem Key) at boot time to the computer’s TPM, and if the measurements match, the TPM releases a shared secret that PureBoot converts to a 6-digit HOTP code and sends to the Librem Key. If the code matches what the Librem Key itself generated, the Librem Key blinks green, letting you know the firmware can be trusted. If it doesn’t match, the Librem Key will blink a steady red LED indefinitely, warning you the firmware might be tampered with.

Once the firmware is trusted, PureBoot then will automatically attempt to boot your system. It tests all of the files in the /boot directory against their previously-trusted signatures and if they match, it will automatically boot, otherwise it will alert you to the issue. This verification doesn’t use the TPM, but instead uses GPG signatures in the /boot directory.

The Security Flaw

Our initial releases of PureBoot for the Librem 14 (and only the Librem 14), contained a simple but serious flaw: the measured_boot option was disabled in coreboot, the free software boot firmware that we use to load PureBoot. As a result, measurements weren’t being stored in the TPM yet PureBoot itself was able to communicate with the Librem Key and the Librem Key would report that the boot firmware was OK. This means that if the boot firmware were changed on the Librem 14, PureBoot wouldn’t have detected it. Because this failure was silent, it took some time to detect it. This security flaw only affected tamper detection on the boot firmware, PureBoot would still detect any changes in files in /boot as that relies on the GPG keys on the Librem Key, not the TPM.

All Librem 14 PureBoot users should upgrade to version 18.1 immediately. This release enables measured_boot and will restore boot firmware tamper detection like in PureBoot releases for other Librem computers. To update PureBoot, follow the steps in our official PureBoot documentation to download the latest PureBoot ROM, or otherwise you can download the Librem 14 PureBoot release directly from here. We understand and appreciate the severity of an issue like this and are tightening up our process to ensure something like this doesn’t happen again.