| |||||||||||||
LSS: Secure BootLSS: Secure BootPosted Sep 13, 2012 19:58 UTC (Thu) by mjg59 (subscriber, #23239)In reply to: LSS: Secure Boot by iabervon Parent article: LSS: Secure Boot
How would you accidentally enrol a key?
(Log in to post comments)
LSS: Secure Boot Posted Sep 13, 2012 21:00 UTC (Thu) by iabervon (subscriber, #722) [Link]
You wouldn't accidentally enroll a key, but Microsoft might not like what you signed and were able to boot using a key you'd enrolled. The existence of a shim like this means that it will be possible to use Windows versions on Secure Boot hardware after Microsoft wants to EOL them. From the point of view of the CA evaluating the trustworthiness of the shim, there's not really any difference between a user signing a kexec-enabled kernel and using it to run Windows XP and a user signing Windows XP and booting it from the shim.
LSS: Secure Boot Posted Sep 13, 2012 21:06 UTC (Thu) by mjg59 (subscriber, #23239) [Link]
It's a Microsoft requirement that a physically present end-user be able to enrol arbitrary keys, so they're not going to object.
LSS: Secure Boot Posted Sep 16, 2012 15:45 UTC (Sun) by mathstuf (subscriber, #69389) [Link]
> …so they're not going to object.
<pedantic>…via that argument.</pedantic> ;)
|
|||||||||||||