User: Password:
|
|
Subscribe / Log in / New account

Implementing UEFI Secure Boot in Fedora

Implementing UEFI Secure Boot in Fedora

Posted Jun 1, 2012 0:08 UTC (Fri) by slashdot (guest, #22014)
Parent article: Implementing UEFI Secure Boot in Fedora

So, Microsoft is willing to sign anything with their keys as long as you pay?

Or if not, how do they check whether the GRUB2 binary Mr. Garrett will submit to them doesn't contain backdoors?


(Log in to post comments)

Implementing UEFI Secure Boot in Fedora

Posted Jun 1, 2012 1:49 UTC (Fri) by Cyberax (✭ supporter ✭, #52523) [Link]

They can't. So they'll just revoke your key and blacklist your company.

Implementing UEFI Secure Boot in Fedora

Posted Jun 1, 2012 2:26 UTC (Fri) by slashdot (guest, #22014) [Link]

Is there really a revocation system for secure boot?

The way the system is described, it gives me the impression that there is just a static key/certificate, and you can't blacklist anything.

Implementing UEFI Secure Boot in Fedora

Posted Jun 1, 2012 2:35 UTC (Fri) by jk (subscriber, #31383) [Link]

There is indeed a revocation system: software is able to add blacklist entries, which may be a hash of a binary, or a key (revoking access to all binaries relying on that key).

However, updating the revocation lists requires your updates to be signed with a key that is already present in firmware.


Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds