With the setup described in the prevoius chapter, we created a system which is able to read biometric data.
The system encapsultes this data into an Attestation message and sends it to the PIA which is the DAA verifier.
We show in the following section how well the different parts of the setup work together.
\section{Testing}
\section{Testing}
The first part of the setup is trusted boot which is well integrated in recent releases of kernel and GRUB bootloader.
Furthermore the optional disk encryption unlocking works fine with the kernel, even when using the manually generated unified kernel.
Only when updating the unified kernel, EFI might have problems loading or finding the correct EFI blob on the boot partition.
Although you can check the entries in the EFI boot loader very easy, you might not check that before rebooting into an updated kernel and end up fixing the boot procedure manually.
Hence, having a system maintained bootloader setup as backup is strongly recommended.
The next part is IMA which appears to have an easy setup but a complex set of consequences.
When setting IMA in fixing mode, logging is enabled and the system slows down significantly.
\autoref{tab:boottimes} shows the performance of system 1 given a setup for a biometric sensor described in \autoref{cha:implementation} with TPM backed disk encryption enabled.
\begin{table}
\renewcommand{\arraystretch}{1.2}
\centering
\caption{Systems used for demonstration prototype}\label{tab:boottimes}
\textbf{Boot with IMA off}&\textasciitilde\,27\,s &&\\
\textbf{Boot with IMA fix}&\textasciitilde\,44\,s &\\
\textbf{Boot with IMA enforce}&&&\\
\textbf{Reboot with IMA off}&\textasciitilde\,28\,s &&\\
\textbf{Reboot with IMA fix}&\textasciitilde\,47\,s &&\\
\textbf{Reboot with IMA enforce}&&&\\
\bottomrule
\end{tabular}
\end{table}
The boot procedure shows basically the slowdown of a file intensive jbo on the system.
When IMA is enabled the IMA log shows 2030 which means---given that the (very slow) hardware TPM had to extend PCR 10 for every line in the log---the slowdown mainly comes from that.
\begin{itemize}
\begin{itemize}
\item Trusted boot works perfectly fine---any update needs an additional reboot to generate PCR vales
\item Trusted boot works perfectly fine---any update needs an additional reboot to generate PCR vales
\item When IMA is active (appraise or enforce), the boot procedure takes significantly more time, but the OS itself does not seem to be slower.
\item When IMA is active (appraise or enforce), the boot procedure takes significantly more time, but the OS itself does not seem to be slower.
