| 0677796c | 16-May-2022 |
Sandrine Bailleux <sandrine.bailleux@arm.com> |
docs(threat-model): broaden the scope of threat #05
- Cite crash reports as an example of sensitive
information. Previously, it might have sounded like this was the
focus of the threat.
- W
docs(threat-model): broaden the scope of threat #05
- Cite crash reports as an example of sensitive
information. Previously, it might have sounded like this was the
focus of the threat.
- Warn about logging high-precision timing information, as well as
conditionally logging (potentially nonsensitive) information
depending on sensitive information.
Change-Id: I33232dcb1e4b5c81efd4cd621b24ab5ac7b58685
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
show more ...
|
| d08c4966 | 16-May-2022 |
Sandrine Bailleux <sandrine.bailleux@arm.com> |
docs(threat-model): make measured boot out of scope
Add an explicit note that measured boot is out of scope of the threat
model. For example, we have no threat related to the secure
management of me
docs(threat-model): make measured boot out of scope
Add an explicit note that measured boot is out of scope of the threat
model. For example, we have no threat related to the secure
management of measurements, nor do we list its security benefits
(e.g. in terms of repudiation).
This might be a future improvement to the threat model but for now
just acknowledge it is not considered.
Change-Id: I2fb799a2ef0951aa681a755a948bd2b67415d156
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
show more ...
|
| 3d6cc210 | 12-May-2022 |
Sandrine Bailleux <sandrine.bailleux@arm.com> |
docs(threat-model): revamp threat #9
Reword the description of threat #9 to make it more future-proof for
Arm CCA. By avoiding specific references to secure or non-secure
contexts, in favour of "wor
docs(threat-model): revamp threat #9
Reword the description of threat #9 to make it more future-proof for
Arm CCA. By avoiding specific references to secure or non-secure
contexts, in favour of "worlds" and "security contexts", we make the
description equally applicable to 2-world and 4-world architectures.
Note that there are other threats that would benefit from such a
similar revamp but this is out of scope of this patch.
Also list malicious secure world code as a potential threat
agent. This seems to be an oversight in the first version of the
threat model (i.e. this change is not related to Arm CCA).
Change-Id: Id8c8424b0a801104c4f3dc70e344ee702d2b259a
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
show more ...
|
| 1b7c82ca | 13-May-2022 |
Sandrine Bailleux <sandrine.bailleux@arm.com> |
docs(threat-model): remove some redundant text in threat #08
The threat description was repeating the threat title.
Change-Id: I67de2c0aab6e86bf33eb91e7562e075fcb76259b
Signed-off-by: Sandrine Bail
docs(threat-model): remove some redundant text in threat #08
The threat description was repeating the threat title.
Change-Id: I67de2c0aab6e86bf33eb91e7562e075fcb76259b
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
show more ...
|
| 4365b30c | 12-May-2022 |
Sandrine Bailleux <sandrine.bailleux@arm.com> |
docs(threat-model): make experimental features out of scope
By nature, experimental features are incomplete pieces of work,
sometimes going under rapid change. Typically, the threat model
implicatio
docs(threat-model): make experimental features out of scope
By nature, experimental features are incomplete pieces of work,
sometimes going under rapid change. Typically, the threat model
implications have not been fully considered yet.
Change-Id: Ice8d4273a789558e912f82cde592da4747b37fdf
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
show more ...
|