Partial key autonomy: Difference between revisions

From OLPC
Jump to navigation Jump to search
(New page: '''Proposal:''' For each party P who so requests, # ask party P to generate #* P_OS_key -- per Firmware security, guards the theft-deterrence code-path thr...)
 
mNo edit summary
Line 12: Line 12:
# have OLPC return a signed version of the customized firmware to party P.
# have OLPC return a signed version of the customized firmware to party P.


By installing the signed customized firmware on a stock machine, party P will be able to autonomously provide builds and activation leases and will be able to execute or modify the theft-deterrence protocol for that machine. Party P may also further delegate these abilities, e.g. with [[Firmware Key and Signature Formats#Version_2|version-2 lease signatures]].
By installing the signed customized firmware on a stock machine, party P will be able to autonomously provide builds and activation leases and will be able to execute or modify the theft-deterrence protocol for that machine. Party P may also further delegate these abilities, e.g. with [[Firmware Key and Signature Formats#Version_2|version-2 lease signatures]]. OLPC will retain responsibility for providing developer keys and firmware updates.

Revision as of 22:50, 24 December 2008

Proposal:

For each party P who so requests,

  1. ask party P to generate
  2. generate a firmware, initramfs, and olpc-update which contain the public values of these keys.
    • alternately, provide the keys through /ofw and rewrite the initramfs and olpc-update code to read /ofw
  3. have OLPC return a signed version of the customized firmware to party P.

By installing the signed customized firmware on a stock machine, party P will be able to autonomously provide builds and activation leases and will be able to execute or modify the theft-deterrence protocol for that machine. Party P may also further delegate these abilities, e.g. with version-2 lease signatures. OLPC will retain responsibility for providing developer keys and firmware updates.