4 ms·

I have no problem with a cryptographically verified boot process, so long as I control the key or verification step. Unfortunately, Intel stripped this freedom

I have no problem with a cryptographically verified boot process, so long as I control the key or verification step. Unfortunately, Intel stripped this freedom from CPU owners by allowing OEMs to lock down the boot process in a manner that cannot be bypassed. Soon Coreboot will be all but dead for machines with Intel processors -- other than Chromebooks which ship with Coreboot. Owners will have to accept the bios that vendors give us. The UEFI legacy boot option also seems to be on its way out, so I expect there will be fewer OS choices in our future too.

yuhong 12y ago
I don't think the option to disable Secure Boot is going anywhere at this point though.
- walterbell 12y ago
  Edit: Measured boot (DRTM, e.g. implemented by Qubes) has some benefits over "Secure Boot" (SRTM), both for firmware modification and key management. http://www.pcworld.com/article/2883903/how-intel-and-pc-makers-prevent-you-from-modifying-your-pcs-firmware.html http://www.pcworld.com/article/2883903/how-intel-and-pc-make..., "There’s also a second option: “Measured Boot” mode, where the hardware securely stores information about the boot process in a trusted platform module (TPM) or Intel Platform Trust Technology (PTT). The operating system could then examine this information, and—if there was a problem—present an error to the user. More on DRTM & SRTM: http://theinvisiblethings.blogspot.com/2011/09/anti-evil-maid.html http://theinvisiblethings.blogspot.com/2011/09/anti-evil-mai...
  - geofft 12y ago
    "Secure Boot" and "SRTM" are different things. Secure Boot is a facility of UEFI, the firmware, to restrict which bootloaders and OSes can load, and prevent them from loading if a signature check fails. It makes sure that the firmware knows and trusts the OS. "SRTM" is a facility of the TPM to inspect what firmware and bootloaders have already loaded and executed, and refuse to unlock an encryption key, attest to the network, etc. if the hashes don't match. It requires a TPM (Secure Boot does not), and crucially it cannot prevent anything from running. It can just refuse to do cryptographic operations depending on what has run. It makes sure that the OS knows and trusts the firmware. They both have the effect of blocking boot sector malware (although from opposite directions), but the way that they work, the requirements for setting them up, the flexibility you get, and the other threats they defend against are rather different. And complementary, it's often a good plan to use them together to tie a nice knot. ("Boot Guard," the topic of this article, is something else entirely, where the hardware checks the signature on the firwmare. The firmware in turn can Secure Boot if it wants.)
    - walterbell 12y ago
      Thanks for the correction.
- ppereira 12y ago
  "Secure Boot" is a farcical misnomer when it prevents you from replacing Windows with OpenBSD.
  - geofft 12y ago
    Why can't you boot it from GRUB?
- pgeorgi 12y ago
  That option primarily exists to provide big Corps with a way to buy new machines and image Windows 7 on them. Once all that legacy is gone, non-Secure Boot isn't necessary anymore from a Wintel point of view. And there won't be much opposition from Linux, given that all major (and most minor) distros now ship Secure Boot enabled.

yuhong 12y ago

I don't think the option to disable Secure Boot is going anywhere at this point though.

walterbell 12y ago
Edit: Measured boot (DRTM, e.g. implemented by Qubes) has some benefits over "Secure Boot" (SRTM), both for firmware modification and key management. http://www.pcworld.com/article/2883903/how-intel-and-pc-makers-prevent-you-from-modifying-your-pcs-firmware.html http://www.pcworld.com/article/2883903/how-intel-and-pc-make..., "There’s also a second option: “Measured Boot” mode, where the hardware securely stores information about the boot process in a trusted platform module (TPM) or Intel Platform Trust Technology (PTT). The operating system could then examine this information, and—if there was a problem—present an error to the user. More on DRTM & SRTM: http://theinvisiblethings.blogspot.com/2011/09/anti-evil-maid.html http://theinvisiblethings.blogspot.com/2011/09/anti-evil-mai...
- geofft 12y ago
  "Secure Boot" and "SRTM" are different things. Secure Boot is a facility of UEFI, the firmware, to restrict which bootloaders and OSes can load, and prevent them from loading if a signature check fails. It makes sure that the firmware knows and trusts the OS. "SRTM" is a facility of the TPM to inspect what firmware and bootloaders have already loaded and executed, and refuse to unlock an encryption key, attest to the network, etc. if the hashes don't match. It requires a TPM (Secure Boot does not), and crucially it cannot prevent anything from running. It can just refuse to do cryptographic operations depending on what has run. It makes sure that the OS knows and trusts the firmware. They both have the effect of blocking boot sector malware (although from opposite directions), but the way that they work, the requirements for setting them up, the flexibility you get, and the other threats they defend against are rather different. And complementary, it's often a good plan to use them together to tie a nice knot. ("Boot Guard," the topic of this article, is something else entirely, where the hardware checks the signature on the firwmare. The firmware in turn can Secure Boot if it wants.)
  - walterbell 12y ago
    Thanks for the correction.
ppereira 12y ago
"Secure Boot" is a farcical misnomer when it prevents you from replacing Windows with OpenBSD.
- geofft 12y ago
  Why can't you boot it from GRUB?
pgeorgi 12y ago
That option primarily exists to provide big Corps with a way to buy new machines and image Windows 7 on them. Once all that legacy is gone, non-Secure Boot isn't necessary anymore from a Wintel point of view. And there won't be much opposition from Linux, given that all major (and most minor) distros now ship Secure Boot enabled.