3 ms·
I haven't read the latest UEFI spec, but if each machine: * shipped with a randomly generated unique key in addition to any others * had an option in the pre-
by kogir 15y ago
I haven't read the latest UEFI spec, but if each machine:
* shipped with a randomly generated unique key in addition to any others
* had an option in the pre-boot firmware to generate new keys signed with this unique machine key
then users who wanted to make signed binaries for their machine could and anyone who didn't care wouldn't. It would still protect from malware as long and the process couldn't be performed outside the (trusted, verified) pre-boot firmware.
There are great security advantages to trusted boot, no matter what operating system you run, so I don't see why most UEFI vendors wouldn't support something like this -- it enables secure boot for consumer and server systems and would still allow OEMs to do all their own customization as signed UEFI programs. Since most OEMs buy their BIOS and UEFI software from someone else, as long as that someone else implements it it's easier for them to keep it them remove it.
In the case of Intel they could make it all easily manageable via AMT.
- tzs 15y agoI have wondered why they didn't do something like that, except I'd make it so that it doesn't ship with the randomly generated key--you'd generate that on the machine itself in the pre-boot environment. That way (1) if your key is compromised you can discard it and generate a new one, and (2) if you buy a used machine, you can generate a new key.