iDRAC10 Security Configuration Guide

Signed Firmware Updates

Enhanced firmware authentication is embedded within many third-party devices which provide signature validation using their own Root-of-Trust mechanisms. This prevents the possible use of a compromised third-party update tool from being used to load malicious firmware into devices like NIC or storage drive (and bypassing the use of signed Dell update packages). Many of the third-party PCIe and storage devices that are shipped with PowerEdge servers use a hardware Root-of-Trust to validate their respective firmware updates.

PowerEdge servers have digitally signed firmware updates for several generations to assure that only authentic firmware is running on the server platform. The firmware packages are digitally signed using SHA-512 hashing with ECDSA-384 encryption for the signature for all key server components including firmware for iDRAC, BIOS, PERC, I/O adapters and LOMs, PSUs, storage drives, FPGA, and backplane controllers. iDRAC scans firmware updates. To verify the authenticity of the firmware running on the system, the silicon-based Root-of-Trust is employed, and current signatures are compared to expected signatures. Any firmware package that fails validation is aborted and an error message is logged into the Lifecycle Controller Log (LCL) to alert IT administrators.

If any firmware in any device is suspected of malicious tampering, IT administrators can rollback many of the platform firmware images to a prior trusted version stored in iDRAC. Retain two versions of device firmware on the server - the existing production version (N) and a prior trusted version (N-1).