3 ms·
Blobs inside the FW image are not subjected to signature checks.
by my123 10y ago
Blobs inside the FW image are not subjected to signature checks.
- zokier 10y agoI think it is bit more complicated than that. I checked some presentations [1] about UEFI/SB, and they do seem to imply that there is potentially some blobs (namely option roms, uefi applications and dxe drivers) that need to pass signature check. I don't know how much such modularity is really used in real life, especially in the boot path, but I think the "best practice" recommendation is to keep dxe core small and have stuff as loadable drivers. [1] eg http://c7zero.info/stuff/Windows8SecureBoot_Bulygin-Furtak-Bazhniuk_BHUSA2013.pdf http://c7zero.info/stuff/Windows8SecureBoot_Bulygin-Furtak-B...
- my123 10y agoEverything that is in the ROM proper isn't checked actually, in TianoCore at least.