Adding a Trusted Execution Environment (TEE) to OpenBMC will allow for a
variety of useful features in the realm of security. One current feature the
BMC suffers from is the ability to securely store any information. A glaring
example of this is that IPMI user passwords are required (by the specification)
to be available as plain-text to be used in RMCP+ authentication. But because
the BMC currently has no method of securing any secrets, it is impossible to
securely encrypt those passwords. Adding a TEE using the ARM TrustZone
extensions will allow this exact scenario to be fixed. But adding a TEE isn't
so simple as just adding a new package to the OpenBMC Yocto build. This talk
dives into the details of what hardware requirements, boot requirements, and
other prerequisites are necessary to be able to securely store secrets on the
BMC. In addition, it looks to future work that can be done with a TEE besides
simply keeping secrets.