LSS: Secure Boot

Posted Sep 13, 2012 19:58 UTC (Thu) by mjg59 (subscriber, #23239)
In reply to: LSS: Secure Boot by iabervon
Parent article: LSS: Secure Boot

How would you accidentally enrol a key?

LSS: Secure Boot

Posted Sep 13, 2012 21:00 UTC (Thu) by iabervon (subscriber, #722) [Link] (2 responses)

You wouldn't accidentally enroll a key, but Microsoft might not like what you signed and were able to boot using a key you'd enrolled. The existence of a shim like this means that it will be possible to use Windows versions on Secure Boot hardware after Microsoft wants to EOL them. From the point of view of the CA evaluating the trustworthiness of the shim, there's not really any difference between a user signing a kexec-enabled kernel and using it to run Windows XP and a user signing Windows XP and booting it from the shim.

LSS: Secure Boot

Posted Sep 13, 2012 21:06 UTC (Thu) by mjg59 (subscriber, #23239) [Link] (1 responses)

It's a Microsoft requirement that a physically present end-user be able to enrol arbitrary keys, so they're not going to object.

LSS: Secure Boot

Posted Sep 16, 2012 15:45 UTC (Sun) by mathstuf (subscriber, #69389) [Link]

> …so they're not going to object.

<pedantic>…via that argument.</pedantic> ;)