Rotating specific key(s)

[Quant-ux]

One of downsides of storing keys locally is the fact an adversary with root privileges can sign and install bootkits. My solution is to this is to store PK and KEK offline, and db on the host's drive. Obviously,db remains unprotected here but if the system gets compromised, only db is affected.

If I'm correct, the EFI signing command rotate-keys is used to rotate all keys so it can't be used to replace a single key. With this in mind, considering my use case, I think the ability to selectively rotate keys would be beneficial.

[Foxboron]

This is implemented in master but hasn't been part of a release yet.

889325e

I can do a release this weekend probably.

[Foxboron]

I still plan to rework the key storage code so in the future keys can be stored on yubikeys, TPMS or PKCS11 devices. That should remove a lot of the issue with having keys available on the system.