efiencrypt

Encrypts an EFI binary using a hash derived from user-defined data (random data, disk sectors, SMBIOS fields, ...)

efiencrypt is a small utility that:

• Computes a cryptographic key: the SHA-256 hash of a collection of "hash components" (random data, disk sectors, SMBIOS fields, ...).
• Encrypts an input EFI binary with this cryptographic key (using AES-256-CBC)
• Generates code that
  • embeds the encrypted EFI binary, the random hash components and the random initialization vector
  • computes again the cryptographic key from the various "hash components" at boot time, thanks to the code coming from this fast SHA-256 implementation
  • decrypts the encrypted EFI binary, thanks to the code coming from this fast AES implementation
• Builds the code with GNU-EFI

The resulting EFI can be booted with QEMU or any UEFI firmware.

Installation

# Install globally (so that `efiencrypt` becomes a CLI command)
npm install -g efiencrypt

# Or use it locally in a project
npm install efiencrypt

The efiencrypt command is exposed on the path when installed globally.

Usage

CLI

Check efiencrypt --help for the full list of options.

Simplest usage:

# Use the default random 32-bytes hash component:
efiencrypt -i input.efi -o output.efi

Usage with SMBIOS dump:

# Extracts smbios data from the computer:
dmidecode --dump-bin smbios.bin
# Use the default system-serial-number and system-uuid SMBIOS fields:
efiencrypt -i input.efi -s smbios.bin -o output.efi

Usage with a configuration file:

efiencrypt -c config.ts

Options passed on the command line override values in the config file.

Configuration file

The configuration file can be a .json, .js or even .ts file (any file accepted in require by node.js).

It should export a Config object.

See test/config.ts for a comprehensive example.

// config.ts
import type { Config } from "efiencrypt";

const config: Config = {
	inputFile: "input.efi",
	outputFile: "output.efi",
	hashComponents: [
		{ type: "random", length: 64 },
		// ...
	],
};

export default config;

API

The package exports a build function to run the build programmatically:

import { build } from "efiencrypt";

await build({
	inputFile: "input.efi",
	outputFile: "output.efi",
	hashComponents: [
		{ type: "random", length: 64 },
		// ...
	],
});