VeraCrypt
aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMounir IDRASSI <mounir.idrassi@idrix.fr>2016-08-14 23:45:10 +0200
committerMounir IDRASSI <mounir.idrassi@idrix.fr>2016-08-15 01:09:19 +0200
commit67031da928735e1d3b6bfca8d393a07d98e478dd (patch)
treef3ac60427bf39de06357eb41e5ebe4da8cdee157
parent87ee61bcb1fcad9e18f703485a04781ff9f6fa53 (diff)
downloadVeraCrypt-67031da928735e1d3b6bfca8d393a07d98e478dd.tar.gz
VeraCrypt-67031da928735e1d3b6bfca8d393a07d98e478dd.zip
Windows: Add DCS EFI Bootloader files that are signed. Add certificates and powershell script to update Secure Boot configuration.
-rw-r--r--src/Boot/EFI/DcsBml.efibin0 -> 8544 bytes
-rw-r--r--src/Boot/EFI/DcsBoot.efibin0 -> 12640 bytes
-rw-r--r--src/Boot/EFI/DcsCfg.efibin0 -> 499072 bytes
-rw-r--r--src/Boot/EFI/DcsInt.efibin0 -> 469504 bytes
-rw-r--r--src/Boot/EFI/DcsRe.efibin0 -> 18304 bytes
-rw-r--r--src/Boot/EFI/LegacySpeaker.efibin0 -> 2784 bytes
-rw-r--r--src/Boot/EFI/Readme.txt13
-rw-r--r--src/Boot/EFI/certs/DCS_key_exchange.crtbin0 -> 1093 bytes
-rw-r--r--src/Boot/EFI/certs/DCS_platform.crtbin0 -> 1341 bytes
-rw-r--r--src/Boot/EFI/certs/DCS_sign.crtbin0 -> 826 bytes
-rw-r--r--src/Boot/EFI/certs/MicCorUEFCA2011_2011-06-27.crtbin0 -> 1556 bytes
-rw-r--r--src/Boot/EFI/certs/MicWinProPCA2011_2011-10-19.crtbin0 -> 1499 bytes
-rw-r--r--src/Boot/EFI/certs/Readme.txt3
-rw-r--r--src/Boot/EFI/sb_set_siglists.ps122
-rw-r--r--src/Boot/EFI/siglists/DCS_key_exchange_SigList.binbin0 -> 1137 bytes
-rw-r--r--src/Boot/EFI/siglists/DCS_key_exchange_SigList_Serialization.binbin0 -> 1179 bytes
-rw-r--r--src/Boot/EFI/siglists/DCS_key_exchange_SigList_Serialization.bin.p7bin0 -> 1996 bytes
-rw-r--r--src/Boot/EFI/siglists/DCS_platform_SigList.binbin0 -> 1385 bytes
-rw-r--r--src/Boot/EFI/siglists/DCS_platform_SigList_Serialization.binbin0 -> 1425 bytes
-rw-r--r--src/Boot/EFI/siglists/DCS_platform_SigList_Serialization.bin.p7bin0 -> 1996 bytes
-rw-r--r--src/Boot/EFI/siglists/DCS_sign_SigList.binbin0 -> 870 bytes
-rw-r--r--src/Boot/EFI/siglists/DCS_sign_SigList_Serialization.binbin0 -> 910 bytes
-rw-r--r--src/Boot/EFI/siglists/DCS_sign_SigList_Serialization.bin.p7bin0 -> 1492 bytes
-rw-r--r--src/Boot/EFI/siglists/MicCorUEFCA2011_2011-06-27_SigList.binbin0 -> 1600 bytes
-rw-r--r--src/Boot/EFI/siglists/MicCorUEFCA2011_2011-06-27_SigList_Serialization.binbin0 -> 1640 bytes
-rw-r--r--src/Boot/EFI/siglists/MicCorUEFCA2011_2011-06-27_SigList_Serialization.bin.p7bin0 -> 1492 bytes
-rw-r--r--src/Boot/EFI/siglists/MicWinProPCA2011_2011-10-19_SigList.binbin0 -> 1543 bytes
-rw-r--r--src/Boot/EFI/siglists/MicWinProPCA2011_2011-10-19_SigList_Serialization.binbin0 -> 1583 bytes
-rw-r--r--src/Boot/EFI/siglists/MicWinProPCA2011_2011-10-19_SigList_Serialization.bin.p7bin0 -> 1492 bytes
29 files changed, 38 insertions, 0 deletions
diff --git a/src/Boot/EFI/DcsBml.efi b/src/Boot/EFI/DcsBml.efi
new file mode 100644
index 00000000..8775ce4c
--- /dev/null
+++ b/src/Boot/EFI/DcsBml.efi
Binary files differ
diff --git a/src/Boot/EFI/DcsBoot.efi b/src/Boot/EFI/DcsBoot.efi
new file mode 100644
index 00000000..03f15633
--- /dev/null
+++ b/src/Boot/EFI/DcsBoot.efi
Binary files differ
diff --git a/src/Boot/EFI/DcsCfg.efi b/src/Boot/EFI/DcsCfg.efi
new file mode 100644
index 00000000..da5a6ee4
--- /dev/null
+++ b/src/Boot/EFI/DcsCfg.efi
Binary files differ
diff --git a/src/Boot/EFI/DcsInt.efi b/src/Boot/EFI/DcsInt.efi
new file mode 100644
index 00000000..666030ba
--- /dev/null
+++ b/src/Boot/EFI/DcsInt.efi
Binary files differ
diff --git a/src/Boot/EFI/DcsRe.efi b/src/Boot/EFI/DcsRe.efi
new file mode 100644
index 00000000..646a79e3
--- /dev/null
+++ b/src/Boot/EFI/DcsRe.efi
Binary files differ
diff --git a/src/Boot/EFI/LegacySpeaker.efi b/src/Boot/EFI/LegacySpeaker.efi
new file mode 100644
index 00000000..5f49a76a
--- /dev/null
+++ b/src/Boot/EFI/LegacySpeaker.efi
Binary files differ
diff --git a/src/Boot/EFI/Readme.txt b/src/Boot/EFI/Readme.txt
new file mode 100644
index 00000000..882c247a
--- /dev/null
+++ b/src/Boot/EFI/Readme.txt
@@ -0,0 +1,13 @@
+To update secure boot configuration
+1. Enter BIOS configuration
+2. Switch Secure boot to setup mode (or custom mode). It deletes PK (platform certificate) and allows to load DCS platform key.
+3. Boot Windows
+4. execute from admin command prompt
+ powershell -File sb_set_siglists.ps1
+It sets in PK (platform key) - DCS_platform
+It sets in KEK (key exchange key) - DCS_key_exchange
+It sets in db - DCS_sign MicWinProPCA2011_2011-10-19 MicCorUEFCA2011_2011-06-27
+
+All DCS modules are protected by DCS_sign.
+All Windows modules are protected by MicWinProPCA2011_2011-10-19
+All SHIM(linux) modules are protected by MicCorUEFCA2011_2011-06-27 \ No newline at end of file
diff --git a/src/Boot/EFI/certs/DCS_key_exchange.crt b/src/Boot/EFI/certs/DCS_key_exchange.crt
new file mode 100644
index 00000000..80bc7ca4
--- /dev/null
+++ b/src/Boot/EFI/certs/DCS_key_exchange.crt
Binary files differ
diff --git a/src/Boot/EFI/certs/DCS_platform.crt b/src/Boot/EFI/certs/DCS_platform.crt
new file mode 100644
index 00000000..a7cf8ce9
--- /dev/null
+++ b/src/Boot/EFI/certs/DCS_platform.crt
Binary files differ
diff --git a/src/Boot/EFI/certs/DCS_sign.crt b/src/Boot/EFI/certs/DCS_sign.crt
new file mode 100644
index 00000000..f0538dbb
--- /dev/null
+++ b/src/Boot/EFI/certs/DCS_sign.crt
Binary files differ
diff --git a/src/Boot/EFI/certs/MicCorUEFCA2011_2011-06-27.crt b/src/Boot/EFI/certs/MicCorUEFCA2011_2011-06-27.crt
new file mode 100644
index 00000000..9aa6ac6c
--- /dev/null
+++ b/src/Boot/EFI/certs/MicCorUEFCA2011_2011-06-27.crt
Binary files differ
diff --git a/src/Boot/EFI/certs/MicWinProPCA2011_2011-10-19.crt b/src/Boot/EFI/certs/MicWinProPCA2011_2011-10-19.crt
new file mode 100644
index 00000000..a6d001c2
--- /dev/null
+++ b/src/Boot/EFI/certs/MicWinProPCA2011_2011-10-19.crt
Binary files differ
diff --git a/src/Boot/EFI/certs/Readme.txt b/src/Boot/EFI/certs/Readme.txt
new file mode 100644
index 00000000..6663a5d1
--- /dev/null
+++ b/src/Boot/EFI/certs/Readme.txt
@@ -0,0 +1,3 @@
+Apart from DCS certificates, there are two public DB entries - one for Windows and one for the UEFI Certificate Authority (CA).
+Windows DB: http://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt
+UEFI DB: http://www.microsoft.com/pkiops/certs/MicCorUEFCA2011_2011-06-27.crt
diff --git a/src/Boot/EFI/sb_set_siglists.ps1 b/src/Boot/EFI/sb_set_siglists.ps1
new file mode 100644
index 00000000..5f664f21
--- /dev/null
+++ b/src/Boot/EFI/sb_set_siglists.ps1
@@ -0,0 +1,22 @@
+Set-ExecutionPolicy Bypass -Force
+Import-Module secureboot
+
+Set-SecureBootUEFI -Name PK -Time 2015-09-11 -Content $null
+Set-SecureBootUEFI -Name KEK -Time 2015-09-11 -Content $null
+Set-SecureBootUEFI -Name db -Time 2015-09-11 -Content $null
+Set-SecureBootUEFI -Name dbx -Time 2015-09-11 -Content $null
+
+Write-Host "Setting self-signed PK..."
+Set-SecureBootUEFI -Time 2016-08-08T00:00:00Z -ContentFilePath siglists\DCS_platform_SigList.bin -SignedFilePath siglists\DCS_platform_SigList_Serialization.bin.p7 -Name PK
+
+Write-Host "Setting PK-signed KEK..."
+Set-SecureBootUEFI -Time 2016-08-08T00:00:00Z -ContentFilePath siglists\DCS_key_exchange_SigList.bin -SignedFilePath siglists\DCS_key_exchange_SigList_Serialization.bin.p7 -Name KEK
+
+Write-Host "Setting KEK-signed DCS cert in db..."
+Set-SecureBootUEFI -Time 2016-08-08T00:00:00Z -ContentFilePath siglists\DCS_sign_SigList.bin -SignedFilePath siglists\DCS_sign_SigList_Serialization.bin.p7 -Name db
+
+Write-Host "Setting KEK-signed MS cert in db..."
+Set-SecureBootUEFI -Time 2016-08-08T00:00:00Z -ContentFilePath siglists\MicWinProPCA2011_2011-10-19_SigList.bin -SignedFilePath siglists\MicWinProPCA2011_2011-10-19_SigList_Serialization.bin.p7 -Name db -AppendWrite:$true
+
+Write-Host "Setting KEK-signed MS UEFI cert in db..."
+Set-SecureBootUEFI -Time 2016-08-08T00:00:00Z -ContentFilePath siglists\MicCorUEFCA2011_2011-06-27_SigList.bin -SignedFilePath siglists\MicCorUEFCA2011_2011-06-27_SigList_Serialization.bin.p7 -Name db -AppendWrite:$true
diff --git a/src/Boot/EFI/siglists/DCS_key_exchange_SigList.bin b/src/Boot/EFI/siglists/DCS_key_exchange_SigList.bin
new file mode 100644
index 00000000..62f5cc6f
--- /dev/null
+++ b/src/Boot/EFI/siglists/DCS_key_exchange_SigList.bin
Binary files differ
diff --git a/src/Boot/EFI/siglists/DCS_key_exchange_SigList_Serialization.bin b/src/Boot/EFI/siglists/DCS_key_exchange_SigList_Serialization.bin
new file mode 100644
index 00000000..1cffcf0c
--- /dev/null
+++ b/src/Boot/EFI/siglists/DCS_key_exchange_SigList_Serialization.bin
Binary files differ
diff --git a/src/Boot/EFI/siglists/DCS_key_exchange_SigList_Serialization.bin.p7 b/src/Boot/EFI/siglists/DCS_key_exchange_SigList_Serialization.bin.p7
new file mode 100644
index 00000000..1e9d29ae
--- /dev/null
+++ b/src/Boot/EFI/siglists/DCS_key_exchange_SigList_Serialization.bin.p7
Binary files differ
diff --git a/src/Boot/EFI/siglists/DCS_platform_SigList.bin b/src/Boot/EFI/siglists/DCS_platform_SigList.bin
new file mode 100644
index 00000000..0b6d7e12
--- /dev/null
+++ b/src/Boot/EFI/siglists/DCS_platform_SigList.bin
Binary files differ
diff --git a/src/Boot/EFI/siglists/DCS_platform_SigList_Serialization.bin b/src/Boot/EFI/siglists/DCS_platform_SigList_Serialization.bin
new file mode 100644
index 00000000..e8fbf79a
--- /dev/null
+++ b/src/Boot/EFI/siglists/DCS_platform_SigList_Serialization.bin
Binary files differ
diff --git a/src/Boot/EFI/siglists/DCS_platform_SigList_Serialization.bin.p7 b/src/Boot/EFI/siglists/DCS_platform_SigList_Serialization.bin.p7
new file mode 100644
index 00000000..19cb86db
--- /dev/null
+++ b/src/Boot/EFI/siglists/DCS_platform_SigList_Serialization.bin.p7
Binary files differ
diff --git a/src/Boot/EFI/siglists/DCS_sign_SigList.bin b/src/Boot/EFI/siglists/DCS_sign_SigList.bin
new file mode 100644
index 00000000..9a3f568b
--- /dev/null
+++ b/src/Boot/EFI/siglists/DCS_sign_SigList.bin
Binary files differ
diff --git a/src/Boot/EFI/siglists/DCS_sign_SigList_Serialization.bin b/src/Boot/EFI/siglists/DCS_sign_SigList_Serialization.bin
new file mode 100644
index 00000000..de58d77d
--- /dev/null
+++ b/src/Boot/EFI/siglists/DCS_sign_SigList_Serialization.bin
Binary files differ
diff --git a/src/Boot/EFI/siglists/DCS_sign_SigList_Serialization.bin.p7 b/src/Boot/EFI/siglists/DCS_sign_SigList_Serialization.bin.p7
new file mode 100644
index 00000000..01753a8b
--- /dev/null
+++ b/src/Boot/EFI/siglists/DCS_sign_SigList_Serialization.bin.p7
Binary files differ
diff --git a/src/Boot/EFI/siglists/MicCorUEFCA2011_2011-06-27_SigList.bin b/src/Boot/EFI/siglists/MicCorUEFCA2011_2011-06-27_SigList.bin
new file mode 100644
index 00000000..413ccab9
--- /dev/null
+++ b/src/Boot/EFI/siglists/MicCorUEFCA2011_2011-06-27_SigList.bin
Binary files differ
diff --git a/src/Boot/EFI/siglists/MicCorUEFCA2011_2011-06-27_SigList_Serialization.bin b/src/Boot/EFI/siglists/MicCorUEFCA2011_2011-06-27_SigList_Serialization.bin
new file mode 100644
index 00000000..735d9626
--- /dev/null
+++ b/src/Boot/EFI/siglists/MicCorUEFCA2011_2011-06-27_SigList_Serialization.bin
Binary files differ
diff --git a/src/Boot/EFI/siglists/MicCorUEFCA2011_2011-06-27_SigList_Serialization.bin.p7 b/src/Boot/EFI/siglists/MicCorUEFCA2011_2011-06-27_SigList_Serialization.bin.p7
new file mode 100644
index 00000000..ed8cefda
--- /dev/null
+++ b/src/Boot/EFI/siglists/MicCorUEFCA2011_2011-06-27_SigList_Serialization.bin.p7
Binary files differ
diff --git a/src/Boot/EFI/siglists/MicWinProPCA2011_2011-10-19_SigList.bin b/src/Boot/EFI/siglists/MicWinProPCA2011_2011-10-19_SigList.bin
new file mode 100644
index 00000000..ac542ca0
--- /dev/null
+++ b/src/Boot/EFI/siglists/MicWinProPCA2011_2011-10-19_SigList.bin
Binary files differ
diff --git a/src/Boot/EFI/siglists/MicWinProPCA2011_2011-10-19_SigList_Serialization.bin b/src/Boot/EFI/siglists/MicWinProPCA2011_2011-10-19_SigList_Serialization.bin
new file mode 100644
index 00000000..9138dae9
--- /dev/null
+++ b/src/Boot/EFI/siglists/MicWinProPCA2011_2011-10-19_SigList_Serialization.bin
Binary files differ
diff --git a/src/Boot/EFI/siglists/MicWinProPCA2011_2011-10-19_SigList_Serialization.bin.p7 b/src/Boot/EFI/siglists/MicWinProPCA2011_2011-10-19_SigList_Serialization.bin.p7
new file mode 100644
index 00000000..b08c60a3
--- /dev/null
+++ b/src/Boot/EFI/siglists/MicWinProPCA2011_2011-10-19_SigList_Serialization.bin.p7
Binary files differ