What is secure boot?

Secure Boot is a security standard developed by members of the PC industry to help make sure that a device boots using only software that is trusted by the Original Equipment Manufacturer (OEM). When a PC starts, the firmware checks the signature of each piece of boot software, including UEFI firmware drivers (also known as Option ROMs), EFI applications, and the operating system. If the signatures are valid, the PC boots, and the firmware gives control to the operating system.

Here are key aspects of Secure Boot:

• Purpose: Secure Boot aims to prevent malicious software from loading during the boot process. It verifies the digital signature of bootloaders and operating system kernels before allowing them to execute.

• UEFI Requirement: Secure Boot relies on the UEFI (Unified Extensible Firmware Interface) firmware standard, which is the modern replacement for the older BIOS.

• How it Works:

  • Digital Signatures: It uses digital signatures to verify the authenticity of bootloaders, operating systems, and UEFI drivers. These signatures are typically generated by trusted authorities, such as the hardware manufacturer or the OS vendor.
  • Trust Database: The UEFI firmware stores a database of trusted signatures. This database (often called the "allow list" or "whitelist") contains the cryptographic keys and certificates that are permitted to execute during the boot process.
  • Verification Process: During boot, the UEFI firmware checks the digital signature of each executable against the trusted signatures in its database. Only software with a valid signature is allowed to run.
  • Revocation: If a piece of software is found to be compromised, its signature can be revoked, preventing it from being loaded in the future.

• Benefits:

  • Protection Against Malware: Prevents boot-sector malware (rootkits) and other malicious code from infecting the system during startup.
  • Operating System Security: Ensures that the operating system kernel is genuine and hasn't been tampered with.

• Considerations:

  • Compatibility: Can sometimes cause compatibility issues with older operating systems or custom kernels that are not properly signed.
  • Dual Booting: Setting up dual boot configurations, especially with operating systems that are not digitally signed, can be more complex.
  • Custom Kernels: Users who compile their own kernels or use custom bootloaders may need to disable Secure Boot or enroll their own keys in the UEFI firmware.

• Disabling Secure Boot: In most systems, Secure Boot can be disabled in the UEFI/BIOS settings. This may be necessary for installing certain operating systems or for troubleshooting boot issues.

• Secure Boot and Linux: Most modern Linux distributions are compatible with Secure Boot. They use a signed bootloader (such as GRUB) that is recognized by the UEFI firmware. However, users may still need to configure Secure Boot settings or enroll additional keys for certain custom configurations.