MSC C6B-SLH
MSC C6B-SLH User Manual
125 / 144
Availability of easy to use tools
Bios images can still be edited with the MSC bios editor, as the editor will automatically ensure that your bios checksum is updated. If customer keys
are provided, the bios editor will be able to patch the public key into the bios and create a signature for the image.
Required Tools for configuring Trusted Update:
-
MSC Bios Editor (version V2.30 or later)
One of the following for creating the required keys:
-
MakeCert.exe (provided by Microsoft WinDDK or Platform SDK)
-
OpenSSL (available from https://www.openssl.org)
You will need a bios image which supports the Trusted Update feature. You can check for Trusted Update support in a variety of ways:
-
With a live system, go into setup and enter the “Firmware Update” submenu. If the last line starts with “Trusted Update”, it is supported in this
bios version.
-
When you load a bios image into the MSC bios editor (V2.30 or later), bios images with support for Trusted Update will show a tab called
“Trusted Update”.
-
Ask your MSC contact if the bios for your platform supports this feature.
Key Creation
The bios and the editor will use the same key file format as the Microsoft signing tools (*.cer for public key certificates, *.pfx for private keys). Creating
a key pair can be done with the tools provided by Microsoft or OpenSSL.Current bios implementations can work with keys that use hash algorithms
SHA256/SHA384/SHA512, and RSA as cryptographic algorithm (key length of 2048 and 4096 bits).
The following examples create RSA keys with a length of 2048 bits, and set hash usage to SHA256.
