Playing with Secure Boot
Secure Boot is an additional optional feature implemented in UEFI intended to help prevent malware execution during a boot process. To enable or disable Secure Boot, you need to access your specific UEFI setup program. This is different for each system manufacturer. Check your system documentation to see how to access the UEFI configuration.
The Secure Boot steps are identical to the regular UEFI booting but an important exception is that it requires the components to be signed and authenticated to be loaded and executed (private and public key pairs are used for authentication). It consists of two launch Roots of Trust (RoT) to build the transitive trust chains:
- The verification RoT is responsible for the signature verification. The verification RoT is the launch RoT, which is what most are referring to when speaking about Secure Boot, and it will lie on the boot flash drive as the RoT for storage to protect the key database. Verify only after the...
