Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
On Ubuntu and possibly Debian systems, you can install packages which contain images which are signed by Ubuntu's EFI key. For example, linux-signed-image-generic-lts-trusty is one of these packages.
Say I have a fully-encrypted disk and an unencrypted boot partition, as is required. I use a PGP encrypted key file to decrypt my disk. What exactly does using these signed images get me in additional security? How trivial is it to generate a "signed" EFI kernel image which is compromised?
With your unencrypted boot partition, malware could theoretically replace your unsigned kernel with its own (say, a hypervisor running your original kernel). This malware would then be undetectable by your system, while having full access to it.
A signed kernel closes this hole, at least in theory: since the malware hypervisor isn't be signed, a EFI BIOS that requires a signed OS would refuse to load it.
The problem with this is that while a random malware author isn't likely to have a signing key recognized by your BIOS, a state-level actor is, and there's a decent chance that an author working for organized crime will.
