I'm going to move my /boot/ folder to a USB to as a security measure to protect against Full Disk Encryption exploits. My question is, is it possible to only allow boot from USB from a single USB device and not any USB that is plugged in?

Thanks all


  • What are the FDE exploits you want to prevent?
    – R15
    Commented Nov 28, 2014 at 9:04
  • Have you considered burning it to a CD instead and booting off of that?
    – Jenny D
    Commented Nov 28, 2014 at 9:26
  • @R15 This link twopointfouristan.wordpress.com/2011/04/17/… explains the process much better than I could
    – user843521
    Commented Nov 28, 2014 at 10:28
  • @JennyD Unfortunately on a Netbook that does not have a built in CD/DVD drive
    – user843521
    Commented Nov 28, 2014 at 10:29
  • Second question: What is the purpose of disabling booting off of other USB devices? Since your disk is encrypted, those devices shouldn't be able to read it anyway, right? They could destroy the data, but not actually get at it - and if you have backups, the destruction isn't a big deal.
    – Jenny D
    Commented Nov 28, 2014 at 10:34

2 Answers 2


I doubt this is possible to set up in the BIOS. However, even if it was, you have a bigger issue: The only way to identify a USB device is by its vendor and device ID. However, all devices by a specific vendor share the same device ID. So even if you could whitelist your own USB, any USB of that same make would also be accepted. Also, I'm pretty sure it's easy to spoof these IDs so even if you didn't have the USB device of the same make, you could spoof it.


You could make use of the secure boot feature present in many computers, if the netbook does support it and the manufacturer hasn't locked it to Microsoft Boot Keys.

What you could do then, is clearing the Secure Boot key database, and then making your own signing key and installing in the BIOS as PK (Platform Key) and KEK (Key Exchange Key).

After this, you sign the /boot/ software on the USB with these keys.

This will not lock out any other USBes from booting your vomputer, so if someone manage to copy your USB key, they can use their own copy. But they can't modify the boot software to for example leak the FDE key, log the password or insert exploits in your encrypted OS.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .