Linux Group Files Complaint With EU Over SecureBoot

[GreatEmerald]

No. You never receive a signing key (Microsoft keep that), and it doesn't matter, anyway - the key used to sign blacklist/whitelist updates is completely different.

Wait, whose key is that, then?

[mjg59]

Wait, whose key is that, then?

DB updates? Microsoft or your hardware vendor.

[duby229]

It's just a matter of time. I don't have any empirical evidence to show, but just past history tends to repeat itself. every single "unhackable" "security" measure has been hacked. All of them. I'm certain that Secureboot won't be any differnet. Especially with the amount of resources being put into its demise.

[GreatEmerald]

DB updates? Microsoft or your hardware vendor.

Hum. If you remove the MS keys, then it should ignore updates signed by Microsoft, right? And if it has to be signed by the hardware vendor, fair enough, but it sounds like something hardware vendors would be lazy to do and neglect. Especially given that there are plenty of different hardware vendors, and they all have to personally sign the same update.

[mjg59]

Hum. If you remove the MS keys, then it should ignore updates signed by Microsoft, right? And if it has to be signed by the hardware vendor, fair enough, but it sounds like something hardware vendors would be lazy to do and neglect. Especially given that there are plenty of different hardware vendors, and they all have to personally sign the same update.

There's two relevant levels of key here. Keys in DB control whether or not something will boot. Keys in KEK are used to authorise updates to DB. Microsoft have a key in DB (which means they can sign things that boot systems) and a key in KEK (which means they can sign updates for the blacklists and whitelists). If you replace Microsoft's key in DB then you probably also want to replace Microsoft's key in KEK.

[GreatEmerald]

There's two relevant levels of key here. Keys in DB control whether or not something will boot. Keys in KEK are used to authorise updates to DB. Microsoft have a key in DB (which means they can sign things that boot systems) and a key in KEK (which means they can sign updates for the blacklists and whitelists). If you replace Microsoft's key in DB then you probably also want to replace Microsoft's key in KEK.

Yea, that's good to know.

[mjg59]

It's just a matter of time. I don't have any empirical evidence to show, but just past history tends to repeat itself. every single "unhackable" "security" measure has been hacked. All of them. I'm certain that Secureboot won't be any differnet. Especially with the amount of resources being put into its demise.

All of them? Where's the jailbreak for the AppleTV 3? Where's the boot-level jailbreak for iOS 6 on the iPhone 5? There's several Android devices that have locked bootloaders and no workaround.

[Serge]

Are you asserting that an unhackable system is possible?

[duby229]

All of them? Where's the jailbreak for the AppleTV 3? Where's the boot-level jailbreak for iOS 6 on the iPhone 5? There's several Android devices that have locked bootloaders and no workaround.

Maybe not yet, but they will. Just like everything else they will.

[mjg59]

Maybe not yet, but they will. Just like everything else they will.

So when you said

every single "unhackable" "security" measure has been hacked. All of them.

, you were wrong?