4 ms·

> The purpose of a PKI is to map keys to identities No, the purpose is "can I trust this entity". The mapping is the mechanism, not the purpose. > There's no

by dijit 9mo ago

> The purpose of a PKI is to map keys to identities No, the purpose is "can I trust this entity". The mapping is the mechanism, not the purpose. > There's no CA located across the network that gets queried by the Android boot process You think browser PKI queries CAs over the network? It doesn't. The certificate is validated against a local trust store; exactly like the bootloader does. If it's not signed by a trusted authority in that store, it's rejected. Same mechanism. > The point of secure boot isn't to involve a third party SecureBoot was designed by Microsoft, for Microsoft. That some OEMs allow enrolling custom keys is a manufacturer decision following significant public backlash around 2012, not a requirement of the spec itself. > The issue has nothing to do with PKI [...] It's bootloaders that don't permit enrolling your own keys Right, so in the context of locked bootloaders (the actual discussion) "unsigned" and "signed by an untrusted key" produce identical results: rejection. Where exactly am I "demonstrably wrong"?

fc417fc802 9mo ago
Look I'm not even clear where you're trying to go with this. You honestly just come across as wanting to argue pointlessly. You compared bootloader validation to TLS verification. The purpose of TLS CAs is to verify that the entity is who they claim to be. Nothing more, nothing less. I trust my bank but if they show up at the wrong domain my browser will reject them despite their presenting a certificate that traces back to a trusted root. It isn't a matter of trust it's a matter of identity. Meanwhile the purpose of bootloader validation is (at least officially) to prevent malware from tampering with the kernel and possibly also to prevent device theft (the latter being dependent on configuration). Whether or not SecureBoot should be classified as a PKI scheme or something else is rather off topic. The underlying purpose is entirely different from that of TLS. > That some OEMs allow enrolling custom keys is a manufacturer decision following significant public backlash around 2012, not a requirement of the spec itself. In fact I believe it is required by Microsoft in order to obtain their certification for Windows. Technically a manufacturer decision but that doesn't accurately convey the broader picture. Again, where are you going with this? It seems as though you're trying to score imaginary points. > Where exactly am I "demonstrably wrong"? Your claimed that the point of SecureBoot is to involve a third party. It is not. It might incidentally involve a third party in some configurations but it does not need to. The actual point of the thing is to prevent low level malware.
- dijit 9mo ago
  I said, from the point of view of the bootloader: signed with an untrusted certificate and unsigned are effectively the same thing. Somehow this was controversial.
- bluebarbet 9mo ago
  This looks like a classic debate where the parties are using marginally different definitions and so talking past each other. You're obviously both right by certain definitions. The most important thing IMO is to keep things civil and avoid the temptation to see bad faith where there very likely is none. Keep this place special.

by dijit 9mo ago

fc417fc802 9mo ago

Look I'm not even clear where you're trying to go with this. You honestly just come across as wanting to argue pointlessly. You compared bootloader validation to TLS verification. The purpose of TLS CAs is to verify that the entity is who they claim to be. Nothing more, nothing less. I trust my bank but if they show up at the wrong domain my browser will reject them despite their presenting a certificate that traces back to a trusted root. It isn't a matter of trust it's a matter of identity. Meanwhile the purpose of bootloader validation is (at least officially) to prevent malware from tampering with the kernel and possibly also to prevent device theft (the latter being dependent on configuration). Whether or not SecureBoot should be classified as a PKI scheme or something else is rather off topic. The underlying purpose is entirely different from that of TLS. > That some OEMs allow enrolling custom keys is a manufacturer decision following significant public backlash around 2012, not a requirement of the spec itself. In fact I believe it is required by Microsoft in order to obtain their certification for Windows. Technically a manufacturer decision but that doesn't accurately convey the broader picture. Again, where are you going with this? It seems as though you're trying to score imaginary points. > Where exactly am I "demonstrably wrong"? Your claimed that the point of SecureBoot is to involve a third party. It is not. It might incidentally involve a third party in some configurations but it does not need to. The actual point of the thing is to prevent low level malware.

dijit 9mo ago
I said, from the point of view of the bootloader: signed with an untrusted certificate and unsigned are effectively the same thing. Somehow this was controversial.
bluebarbet 9mo ago
This looks like a classic debate where the parties are using marginally different definitions and so talking past each other. You're obviously both right by certain definitions. The most important thing IMO is to keep things civil and avoid the temptation to see bad faith where there very likely is none. Keep this place special.