Ensuring best practices in the compute system supply chain is critical.\u00a0 This effort becomes challenging when managing multiple code streams and the certification keys that enable them.<\/p>\n
One area of concern that has been the reoccurance of firmware test keys found in production systems.\u00a0 These test keys support AMI\u2019s approach to increase efficiency of firmware integration during system development.\u00a0 The keys are only intended to be used during development and should never remain in place as systems are placed into production.<\/p>\n
AMI has evaluated its offering of these test keys to its partners.\u00a0 While understanding the improvements to partner efficiency during development, there is risk that best practices might not be met, creating exposure of these keys in production systems.<\/p>\n
The alternative to providing these test keys would be that AMI partners would have the burden of generating the test keys themselves for development.\u00a0 While this would remove AMI\u2019s exposure to having AMI-generated test keys found in production systems, this would still not remove the need for best practices in the supply chain for having the partner-generated test keys replaced prior to production.<\/p>\n
In order to continue to support the efficient system development of partner systems, AMI has chosen to maintain its approach toward efficient system development.\u00a0 As such AMI will continue to deliver tools, including test cert keys, to its partners, while committing to efforts that help ensure best practices are followed.\u00a0 AMI has incrementally added safeguards in its firmware, such as partner alerts when test keys are in use in code builds that include warnings in the BIOS setup screens, notifying the user that test keys are present.<\/p>\n
Supporting the transition from development to production, AMI offers the AMI CLEFs firmware signing tool.\u00a0 This cloud-based service generates the necessary keys for AMI firmware in production, maintaining the private keys in a Cloud HSM.\u00a0 By providing this service, AMI is assisting its partners in transitioning from the test keys that are used in development to secure keys that are used in production systems.<\/p>\n
AMI continues to evaluate how it contributes to efficient system development and best practices.<\/p>\n
Additionally, AMI now offers various products and features, such as Tektagon Platform Root of Trust with encryption key management and remote attestation support, ensuring platform firmware resilience for host and peripheral devices.<\/p>\n
In the end, ensuring best practices in the supply chain is necessary to avoid issues, like the proliferation of insecure test certs being used in production systems.\u00a0 Often following the processes associated with these practices is challenging.\u00a0\u00a0 AMI understands these challenges but is committed to helping maintain a secure supply chain.\u00a0 AMI will continue to support this effort, providing the necessary tools and support that help ensure a secure supply chain.<\/p>\n","protected":false},"excerpt":{"rendered":"
Ensuring best practices in the compute system supply chain is critical.\u00a0 This effort becomes challenging when managing multiple code streams and the certification keys that enable them. One area of concern that has been the reoccurance of firmware test keys found in production systems.\u00a0 These test keys support AMI\u2019s approach to increase efficiency of firmware […]<\/p>\n","protected":false},"author":1,"featured_media":834,"comment_status":"open","ping_status":"open","template":"","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","content-type":"","footnotes":""},"project_category":[1499],"project_tag":[1631,1546,1632],"class_list":["post-833","project","type-project","status-publish","has-post-thumbnail","hentry","project_category-blog","project_tag-firmlysecure","project_tag-firmware-security","project_tag-platform-root-of-trust","topics-tektagon"],"yoast_head":"\n