2022/09/14

[Michael Kubacki (makubacki)]

User-Facing API Design:

• We would like to avoid overloaded APIs
• A key area is how to take in and enforce "variable policy" (variable security policy)
• We also need the ability to advertise what capabilities are provided

Idea on the concept of having two types of policy:

1. One that applies at boot time (that is more known and strict)
2. One that applies at OS runtime

Note: We cannot assume that the platform can supply a pre-built policy.

• We are aware of some platforms where it is not possible for the platform to pre-define the policy

How do we report our variable capabilities to the OS?

• We thought reporting the capabilities directly from a well-known UEFI variable would work well
• We still need to define exactly what we report and the format of the variable data

On TEEs:

• Do we want to make more individual calls?
  • If we did that, we would have to have a way to trust data passed between calls (like an HMAC)
• Or make a single (or less) calls that perform more work in the TEE?
  • This would be more like what is done today, where MM performs a large portion of the actual workflow

Focus on the next week is working toward completing the Variable Design Completion milestone.

Please use discussions to ask questions and share ideas while working on those.

[Michael Kubacki (makubacki)]

@microsoft/project-mu-uefi-variable-devs - Today's notes. Please let me know if I missed anything.