OCP Secure boot必要特性

三点必需要求：

The platform components must: 

1. Provide a mechanism for securely anchoring a root of trust public key. // 提供一种用于安全地锚定信任根公钥的机制。

2. Verify the device firmware digital signature using the anchored public key // 使用锚定的公钥验证设备固件数字签名

3. Provide a mechanism for revoking previously signed firmware// 提供一种机制来撤销以前签名的固件

当前标准：

1. Authenticating all mutable firmware in system devices (flash for BIOS, BMC, microcontroller(s),CPLD, etc)//认证系统设备中的所有可变固件

2. Existing standards/protocols://现有标准

2.1. NIST SP 800-193 “Platform Firmware Resiliency Guidelines” //“平台固件韧性启动指导”

2.2. NIST SP 800-57 “Recommendation for Key Management” //“密码管理建议”

2.3. NIST SP 800-147 “BIOS Protection Guidelines”//"BIOS保护指南”

2.4. NIST SP 800-147B “BIOS Protection Guidelines for Servers//”服务器BIOS保护指南"

2.5. NIST FIPS 186-4 Digital Signature Standard (DSS)//"数字签名标准"