Protecting systems with the TPM [LWN.net]

Protecting systems with the TPM

Posted Feb 11, 2016 15:25 UTC (Thu) by anton (subscriber, #25547)
Parent article: Protecting systems with the TPM

The scenario of locked-down systems where the owner is not in control is very much a reality for users of iPhones and game consoles. With UEFI Secure Boot, PCs can be configured to only boot signed OSs, and isn't that required by some Windows versions nowadays? And while the Windows 8 Logo requirements still required to be able to turn Secure Boot off, that is no longer the case for Windows 10. I guess that, likewise, at some point Microsoft will stop signing Linux boot loaders.

So if locked-down Windows-only PCs have not come about, it seems to me that they just have not come about yet.

Protecting systems with the TPM

Posted Feb 11, 2016 18:07 UTC (Thu) by pjones (subscriber, #31722) [Link]

Stopping signing 3rd party bootloaders would not make life easier for Microsoft.

Aside from political problems with doing that, which they're keenly aware of, one immediate result would be that vendors wouldn't tell MS when there's a security problem, because having a loader blacklisted would hurt too much. That means vulnerable loaders would rarely, if ever, be blacklisted. This is a scenario which significantly weakens Microsoft's ability to use Secure Boot to protect their OS and their customers' systems.

The cat is out of the bag on signing our bootloaders. It's not a thing they can just stop doing.

It's not happening.

What may happen is vendors whose products are in markets that don't require Windows compatibility could implement Secure Boot, with an entirely different set of trusted keys. But that's the scenario we've already got - it's exactly like phone bootloader locking, just with a different mechanism.