I've read a few articles recently about the UEFI Secure Boot feature, and how Microsoft will be requiring it to be enabled by default on all Windows 8 certified x86 systems. In theory, it sounds like a good idea - the system will check the boot loader for integrity before every boot. However, it also provides some complications.
The primary problem arises when someone wants to run a non-Microsoft OS on Windows 8 certified x86 hardware. Since the hardware will have Secure Boot enabled, and will likely only have Microsoft's key installed by default, the user has to work around the problem in one of a several ways:
- Disable Secure Boot - This is, of course, the least ideal solution. However, for some, it may be the only available option.
- Install a custom certificate - An option for the technically inclined, but not likely one that normal end-users will easily consider.
- Choose an OS with a boot loader signed by Microsoft - This is probably the most end-user friendly, though it may limit your options. Fedora has announced that they will be among these options. This requires no modifications to the UEFI or mucking about with custom certificates - you just install the Microsoft-signed OS and go.
- Get your boot loader signed by Microsoft - Perhaps the least preferable option, since it has an actual cost to it ($99 one-time fee). However, it's useful if you're making your own distro and want to share it with friends.
Those last two options are really my point of concern, though. If it only costs $99, one-time, to have the privilege of Microsoft signing all your boot loaders, is it really that big of a barrier to malware writers who stand to make millions off of their Microsoft-signed rootkits?
Is there something I'm missing here, or could this Secure Boot requirement (and all that's been built up to support it) really lead to false sense of security enhancement? What sort of complications could arise if the system is in fact abused in this way? Will we have to update our UEFIs every time a new CRL gets published?