I know the question is rather broad because I am not specifying which hardware and which OS, but that is intentional. I know there should be a root of trust verification in hardware (ROM) before the image is trusted and installed. But are there are any other restrictions? I mean, does the presence of another peripheral/hardware change the scenario?
2
-
Ideally, it might possibly be quite nice to have a secure boot process that validated not only that the machine's UEFI firmware was signed & unaltered before letting the OS load but also the firmware present inside at least some individual hardware components (SSD/hard drive, networking chips/card, video card, etc.). And while you were implementing the capabilities needed for that to be possible you might also allow those checks to be extended to some types of less-permanently attached peripherals, removable media, etc. But, to my understanding, that's well beyond the current UEFI design.– mostlyinformedCommented Sep 21, 2016 at 10:08
-
Once a trusted OS is booted by Secure Boot, the OS can verify the firmware in other hardwares that supports such verification. I don't think see how putting such verification in Secure Boot level adds anything.– Lie RyanCommented Jan 19, 2017 at 10:38
Add a comment
|
1 Answer
No. Secure boot is intended of providing a chain of trust for the software path. So for example, if you boot a CD, the secure boot will verify the CD is signed.
But if you boot from a harddrive, theres no need to check if the CD is "trusted" because the CD contents is not involved in the boot process.
When the BIOS has handed over the booting process to the signed first stage bootloader (MBR) on the harddrive, its the first stage bootloader's responsibility to verify the second stage loader, that its signed. And so on, the second stage will then verify kernels and boot drivers are signed, and when main OS boot up, the main OS will then verify other components.
If added hardware causes the computer to select another boot path, for example a added PCIe drive or similiar, and this boot path contains data that fail signature validation, of course secure boot will fail.
Added hardware such as keyboard or such, kan be prevented by setting up policies in main OS. Since no key input is accepted until the main OS is started anyways, the computer will be secure. The only exception is the BIOS prompt, but that can be protected with a password.
answered Sep 21, 2016 at 5:24
