-
Notifications
You must be signed in to change notification settings - Fork 80
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Rotating specific key(s) #249
Labels
enhancement
New feature or request
Comments
This is implemented in I can do a release this weekend probably. |
I still plan to rework the key storage code so in the future keys can be stored on yubikeys, TPMS or PKCS11 devices. That should remove a lot of the issue with having keys available on the system. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
One of downsides of storing keys locally is the fact an adversary with root privileges can sign and install bootkits. My solution is to this is to store
PK
andKEK
offline, anddb
on the host's drive. Obviously,db
remains unprotected here but if the system gets compromised, onlydb
is affected.If I'm correct, the EFI signing command
rotate-keys
is used to rotate all keys so it can't be used to replace a single key. With this in mind, considering my use case, I think the ability to selectively rotate keys would be beneficial.The text was updated successfully, but these errors were encountered: