2 ms·
What exactly is Windows supposed to verify? There isn’t a standard PCR with some standard value indicating that a certain image was booted. DRTM is a credible
by amluto 4y ago
What exactly is Windows supposed to verify? There isn’t a standard PCR with some standard value indicating that a certain image was booted.
DRTM is a credible (sort of) alternative, but at that point Secure Boot isn’t really necessary — the whole point of DRTM is that you verify the current state of the system, not how it got there.
- mjg59 4y ago> There isn’t a standard PCR with some standard value indicating that a certain image was booted. No, but there is a standard PCR with a standard value indicating that a certain certificate was used to sign what was booted, and Windows is signed with its own certificate rather than the third party UEFI CA one.
- amluto 4y agoNice, so MS gets better TPM-based assurance than anyone else.