mirror of
https://github.com/linuxboot/heads.git
synced 2024-12-20 21:43:11 +00:00
31cf85b707
The Librem Key is a custom device USB-based security token Nitrokey is producing for Purism and among other things it has custom firmware created for use with Heads. In particular, when a board is configured with CONFIG_LIBREMKEY, this custom firmware allows Heads to use the sealed TOTP secret to also send an HOTP authentication to the Librem Key. If the HOTP code is successful, the Librem Key will blink a green LED, if unsuccessful it will blink red, thereby informing the user that Heads has been tampered with without requiring them to use a phone to validate the TOTP secret. Heads will still use and show the TOTP secret, in case the user wants to validate both codes (in case the Librem Key was lost or is no longer trusted). It will also show the result of the HOTP verification (but not the code itself), even though the user should trust only what the Librem Key displays, so the user can confirm that both the device and Heads are in sync. If HOTP is enabled, Heads will maintain a new TPM counter separate from the Heads TPM counter that will increment each time HOTP codes are checked. This change also modifies the routines that update TOTP so that if the Librem Key executables are present it will also update HOTP codes and synchronize them with a Librem Key.
38 lines
960 B
Plaintext
38 lines
960 B
Plaintext
# Configuration for a librem13v2
|
|
CONFIG_LINUX_CONFIG=config/linux-librem13v2.config
|
|
CONFIG_COREBOOT_CONFIG=config/coreboot-librem13v2.config
|
|
|
|
export CONFIG_COREBOOT=y
|
|
CONFIG_CRYPTSETUP=y
|
|
CONFIG_FLASHROM=y
|
|
CONFIG_FLASHTOOLS=y
|
|
CONFIG_GPG=y
|
|
CONFIG_KEXEC=y
|
|
CONFIG_UTIL_LINUX=y
|
|
CONFIG_LVM2=y
|
|
CONFIG_MBEDTLS=y
|
|
CONFIG_PCIUTILS=y
|
|
CONFIG_POPT=y
|
|
CONFIG_QRENCODE=y
|
|
CONFIG_TPMTOTP=y
|
|
|
|
#CONFIG_SLANG=y
|
|
#CONFIG_NEWT=y
|
|
CONFIG_CAIRO=y
|
|
CONFIG_FBWHIPTAIL=y
|
|
CONFIG_LIBREMKEY=y
|
|
|
|
CONFIG_LINUX_USB=y
|
|
|
|
export CONFIG_TPM=y
|
|
export CONFIG_BOOTSCRIPT=/bin/gui-init
|
|
export CONFIG_BOOT_REQ_HASH=n
|
|
export CONFIG_BOOT_REQ_ROLLBACK=n
|
|
export CONFIG_BOOT_KERNEL_ADD="iommu=pt"
|
|
export CONFIG_BOOT_KERNEL_REMOVE=""
|
|
export CONFIG_BOOT_DEV="/dev/sda1"
|
|
export CONFIG_BOOT_GUI_MENU_NAME="Purism Librem 13v2 Heads Boot Menu"
|
|
export CONFIG_USB_BOOT_DEV="/dev/sdb1"
|
|
export CONFIG_WARNING_BG_COLOR="--background-gradient 0 0 0 150 125 0"
|
|
export CONFIG_ERROR_BG_COLOR="--background-gradient 0 0 0 150 0 0"
|