secureboot

Secure Boot is a security standard part of the Unified Extensible Firmware Interface (UEFI) designed to ensure that a computer boots using trusted software. It aims to prevent the execution of unauthorized or tampered bootloaders, kernels, and other early-boot components by validating their digital signatures before they are allowed to run.

The security model relies on a hierarchy of cryptographic keys and signature databases. A Platform Key (PK) establishes a trust boundary for the platform. Key Exchange Keys (KEK) control updates to the allowed (db) and disallowed (dbx) signature databases. The db contains certificates and public keys that are considered trusted for boot components, while the dbx holds signatures that should be blocked. During boot, the firmware checks that the bootloader and related binaries are signed by a trusted key in the db (directly or via a chain of trust) and are not listed in the dbx.

Implementation and usage vary by system. Many operating systems support Secure Boot, with Windows typically relying on Microsoft‑supplied keys, while Linux distributions provide signed bootloaders (such as shim and GRUB) that can chain to trusted keys and, if desired, enroll additional user keys (Machine Owner Keys). Secure Boot can usually be enabled or disabled in UEFI firmware settings, though some devices enforce a Secure Boot policy.

Limitations and scope are important to note. Secure Boot protects against tampering during the initial boot sequence but does not defend against all forms of malware or runtime attacks, nor does it by itself secure firmware updates. It can also complicate multi-boot setups or the use of unsigned drivers. Proper key management is essential to maintain a usable and secure platform.