Secure Boot

[#1]

Secure Boot

---

Definition

The UEFI 2.3.1 Errata C specification (or higher) defines a protocol known as secure boot, which can secure the boot process by preventing the loading of drivers or OS loaders that are not signed with an acceptable digital signature. The mechanical details of how precisely these drivers are to be signed are not specified. When secure boot is enabled, it is initially placed in setup mode, which allows a public key known as the Platform key (PK) to be written to the firmware. Once the key is written, secure boot enters "User" mode, where only drivers and loaders signed with the platform key can be loaded by the firmware. Additional Key Exchange Keys (KEK) can be added to a database stored in memory to allow other certificates to be used, but they must still have a connection to the private portion of the Platform key. Secure boot can also be placed in Custom mode, where additional public keys can be added to the system that do not match the private key.

---

References

1. Wikipedia: https://en.wikipedia.org/wiki/Unified_Extensible_Firmware_Interface#Secure

Article in other languages:

• Deutsch
• Nederlands