Connectionless trusted computing base recovery

1. A system comprising:

one or more processors to process data;

hardware including a hardware RoT (root of trust), wherein the hardware RoT includes:

fuses to establish original credentials of the system, the original credentials including a chipset key and a certificate issued by a vendor certificate authority (CA), and

a read-only memory (ROM) to derive a ROM CA private key based at least in part on the chipset key and to derive a public key based at least in part on the ROM CA private key; and

firmware including a firmware TCB (trusted computing base), the firmware having credentials including one or more certificates and one or more keys;

wherein the one or more processors are to:

determine that the firmware TCB is compromised and that the hardware RoT is intact;

issue new credentials by the hardware RoT for the firmware, wherein issuing the new credentials for the firmware includes setting a serial number of a firmware certificate to include an application ID of the firmware and a version number or security version number (SVN) of the firmware; and

revoke one or more old versions of the credentials for the firmware and

wherein the hardware RoT serves as an on-die certificate authority (ODCA), the hardware RoT to issue the new credentials for the firmware without utilizing a connection to a backend server of the vendor.

2. The system of claim 1 , wherein revoking one or more old versions of the credentials for the firmware include entering the one or more old versions into a credential revocation list (CRL).

3. The system of claim 2 , wherein entering the one or more old versions into the CRL includes one of:

for compromise of a private key of a certificate on an individual part, entering a serial number associated with the individual part into the CRL;

for a compromise of all parts because of a firmware vulnerability, entering a serial number associated with the firmware in the CRL; and

for compromise of all parts due to a hardware vulnerability, entering a producing issuing certificate authority into the CRL.

4. The system of claim 3 , wherein credentials for the system include credentials issued for multiple levels.

5. The system of claim 4 , wherein the multiple levels include:

read-only memory CA (Certificate Authority) credentials;

kernel CA credentials;

application credentials; and

leaf credentials.

6. The system of claim 5 , wherein the multiple levels further include:

root CA credentials;

product type credentials; and

product generation credentials.

7. The system of claim 1 , wherein the one or more processors are further to perform corrective action on the firmware.

8. The system of claim 1 , wherein credentials for the system are in compliance with a public key infrastructure (PKI) built upon X.509 and RFC5280 standards for public key certificates.

9. The system of claim 1 , wherein the ROM CA private key is not exposed outside of the ROM.

10. One or more non-transitory computer-readable storage mediums having stored thereon executable computer program instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:

determining that firmware TCB (trusted computing base) of a computing system is compromised and that a hardware RoT (root of trust) of the computing system is intact, wherein credentials for the firmware include one or more certificates and one or more keys, and wherein the hardware RoT includes:

fuses to establish original credentials of the computing system, the original credentials including a chipset key and a certificate issued by a vendor certificate authority (CA), and

a read-only memory (ROM) to derive a ROM CA private key based at least in part on the chipset key and to derive a public key based at least in part on the ROM CA private key;

issuing new credentials by the hardware RoT of the computing system to the firmware of the computing system, wherein issuing the new credentials for the firmware includes setting a serial number of a firmware certificate to include an application ID of the firmware and a version number or security version number (SVN) of the firmware; and

revoking one or more old versions of the credentials for the firmware;

wherein the hardware RoT serves as an on-die certificate authority (ODCA), the hardware RoT to issue the new credentials for the firmware without utilizing a connection to a backend server of the vendor.

11. The storage mediums of claim 10 , wherein revoking the one or more old versions of the credentials for the firmware include entering the one or more old versions into a credential revocation list (CRL).

12. The storage mediums of claim 11 , wherein entering the one or more old versions into the CRL includes one of:

for compromise of a private key of a certificate on an individual part, entering a serial number associated with the individual part into the CRL;

for a compromise of all parts because of a firmware vulnerability, entering a serial number associated with the firmware in the CRL; and

for compromise of all parts due to a hardware vulnerability, entering a producing issuing certificate authority into the CRL.

13. The storage mediums of claim 12 , wherein credentials for the system include credentials issued for multiple levels.

14. The storage mediums of claim 10 , wherein the instructions further include instructions for:

performing corrective action on the firmware.

15. A method comprising:

determining that firmware TCB (trusted computing base) of a computing system is compromised and that a hardware RoT (root of trust) of the computing system is intact wherein credentials for the firmware include one or more certificates and one or more keys, and wherein the hardware RoT includes:

fuses to establish original credentials of the computing system, the original credentials including a chipset key and a certificate issued by a vendor certificate authority (CA), and

a read-only memory (ROM) to derive a ROM CA private key based at least in part on the chipset key and to derive a public key based at least in part on the ROM CA private key;

issuing new credentials by the hardware RoT of the computing system to the firmware of the computing system, wherein issuing the new credentials for the firmware includes setting a serial number of a firmware certificate to include an application ID of the firmware and a version number or security version number (SVN) of firmware; and

revoking one or more old versions of the credentials for the firmware;

wherein the hardware RoT serves as an on-die certificate authority (ODCA), the hardware RoT to issue the new credentials for the firmware without utilizing a connection to a backend server of the vendor.

16. The method of claim 15 , wherein revoking the one or more old versions of the credentials for the firmware include entering the one or more old versions into a credential revocation list (CRL).

17. The method of claim 16 , wherein entering the one or more old versions into the CRL includes one of:

for compromise of a private key of a certificate on an individual part, entering a serial number associated with the individual part into the CRL;

for a compromise of all parts because of a firmware vulnerability, entering a serial number associated with the firmware in the CRL; and

for compromise of all parts due to a hardware vulnerability, entering a producing issuing certificate authority into the CRL.

18. The method of claim 16 , wherein credentials for the system include credentials issued for multiple levels.

19. The method of claim 15 , further comprising:

performing corrective action on the firmware.

20. An apparatus comprising:

one or more processors to process data;

one or more memory devices for storage of data for processing; and

an embedded system including:

a hardware RoT (root of trust), wherein the hardware RoT includes:

fuses to establish original credentials of the system, the original credentials including a chipset key and a certificate issued by a vendor certificate authority (CA), and

a read-only memory (ROM) to derive a ROM CA private key based at least in part on the chipset key and to derive a public key based at least in part on the ROM CA private key; and

one or more non-volatile memory devices for storage of firmware including a firmware TCB (trusted computing base), the firmware having credentials including one or more certificates and one or more keys;

wherein the one or more processors are to:

determine that the firmware TCB is compromised and that the hardware RoT is intact;

issue new credentials by the hardware RoT for the firmware, wherein issuing the new credentials for the firmware includes setting a serial number of a firmware certificate to include an application ID of the firmware and a version number or security version number (SVN) of the firmware; and

revoke one or more old versions of the credentials for the firmware and

wherein the hardware RoT serves as an on-die certificate authority (ODCA), the hardware RoT to issue the new credentials for the firmware without utilizing a connection to a backend server of the vendor.

21. The apparatus of claim 20 , wherein revoking one or more old versions of the credentials for the firmware include entering the one or more old versions into a credential revocation list (CRL).