4 ms·
Does the Microsoft signing process require that the shim ensure that the chainloaded bootloaders are signed? Does this also require that kernel drivers are sign
by tmzt 14y ago
Does the Microsoft signing process require that the shim ensure that the chainloaded bootloaders are signed? Does this also require that kernel drivers are signed? How does this affect access to lower system memory as the root user? And what key must be used to sign the kernel modules? (Is the CA chain verified by the shim or secureboot somehow?)
- mjg59 14y agoThe signing process doesn't, but Microsoft reserve the right to revoke the binary's hash if it's used to attack other systems. Implementations that don't verify drivers are going to be fairly easy to circumvent into use as an arbitrary bootloader for unsigned or compromised content, and if the blackhats do so then revocation is a likely outcome. There's no explicit list of required implementation policies. People are free to implement whatever policy they want, based on their perceptions of the risk of revocation.