3 ms·
you need something that can decrypt the kernel from the encrypted image and then load it. OVMF + the efi stub can't do that whereas grub can read the luks form
by jejb 6y ago
you need something that can decrypt the kernel from the encrypted image and then load it. OVMF + the efi stub can't do that whereas grub can read the luks format.
- usr1106 6y agoWhy do you need to encrypt the kernel? It should not contain any secrets and it can he signed.
- jejb 6y agothe encryption of the image isn't just about protecting secrets, it's also about making sure the host owner can't tamper with the image. If the kernel isn't part of the encrypted image, it can be substituted by the host owner and the new version could leak any secret they chose. Signing, as I said in the article, is a possible solution but it's more complex to implement than simply putting everything into the encrypted image to assure being both confidential and tamper proof.