docs: add U-Boot console FIDO2/U2F gate idea (draft, needs ADR)#43
Merged
Conversation
Corrected + grounded version of a raw chat-attachment idea (fictional u2f.h API, libu2f-server misuse, non-existent do_shell command). Flags it as Idea-status, needs an ADR before scoping. No existing work covers this gap.
Member
Author
|
Added ADR-027 resolving the scoping questions this doc left open: ARM64-only, CTAP1/U2F (not CTAP2), hook at Still Proposed, not scheduled into a Phase F sub-phase — waiting on (1) Phase F0-F3 landing far enough to know each board's Path A/B storage answer, and (2) a standalone QEMU USB-HID-passthrough spike of the U2F client, deliberately decoupled from the fTPM roadmap so it can't destabilize Phase F. FUTURE.md and TODO.md updated to point at ADR-027 instead of "needs an ADR." |
…d scoping Scopes the U-Boot-console-U2F idea: ARM64-only, CTAP1/U2F, hook at abortboot() alongside CONFIG_AUTOBOOT_ENCRYPTION, storage piggybacked on ADR-018/019/020, mandatory backup-key recovery. Still Proposed -- not scheduled into Phase F.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a corrected, grounded version of the U-Boot-shell-U2F idea submitted via chat attachment to
FUTURE.md(new Idea (unscoped) section) and links it fromTODO.md.What was wrong with the submitted sketch: invented
<u2f.h>/u2f_authenticate()API, misuse oflibu2f-server(that's a relying-party server verifier, not an embedded client), a `do_shell" command that doesn't exist in mainline U-Boot, and pre-Kconfig Makefile style.What's real and kept: the underlying idea is good — U-Boot's
abortboot()/autoboot break-in path (common/autoboot.c) is a real gap; everything else in FUTURE.md hardens the chain through U-Boot but nothing gates U-Boot's own interactive console. ExistingCONFIG_AUTOBOOT_ENCRYPTION(shared password) is the closest existing primitive — a U2F touch would be a hardware-bound upgrade to that same choke point.Status: flagged as Idea, needs an ADR before scoping into a phase (key storage/enrollment decision overlaps ADR-018/019/020). Not merged into the phased roadmap.
Sorted: nothing already in progress or done covers this — it's a new gap, distinct from the shipped host-side FIDO2 work (LUKS2 unlock, pam-u2f, SSH, homed) and distinct from the ARM64 fTPM/TF-A/OP-TEE Phase F work in flight.