Hacker News Reader

Comment by bogomipz | Hacker News Reader

I was struck by the following passage:

>including Secure Boot, which even now requires FOSS users to purchase a license from Microsoft to boot FOSS on affected machines that lack an appropriate Secure Boot override."

Can someone explain this to me, would this be for instance be Lenovo laptops making a deal with Microsoft since Windows is the default OS installed on these laptops? Is Microsoft mandating all OEMs/hardware vendors to configure secure boot with a MS signing key? Even if I order a laptop with no OS installed?

View on HN

Secure boot has 4 types of keys:

The signature database (db) and forbidden signature database (dbx) contain a whitelist and blacklist respectivly of keys, signatures, and hashes that are trusted to run.

Updates to either of the above lists must be signed by a Key Exchange Key (KEK). Most implementations allow multiple Key Exchanges Keys.

Updates to the list of Key Exchange Keys must be signed by the Platform Key (PK). Most implementations only allow 1 PK, and that PK is Microsoft's.

This means that any binary run on a secure boot machine with Microsoft's PK has a chain of trust rooted at Microsoft.

It may be possible to update the PK before transitioning the system to secure mode; but most consumer devices ship already in secure mode. This is different from simply disabling secure boot, which would still not allow you to update PK (for obvious reasons).

EDIT: It appears that it is called "user mode" and "setup mode" instead of secure mode.

Also it seems that some systems allow you to re-enter setup mode from the "bios" [0].

On an unrelated note, what do we call the firmware provided settings app now that it is no longer part of the BIOS.

[0] https://wiki.gentoo.org/wiki/Sakaki%27s_EFI_Install_Guide/Co...

Thanks for the detailed answer. In regards to:

>" Most implementations only allow 1 PK, and that PK is Microsoft's."

Isn't this a bit monopolistic and coercive though? "If you want the Microsoft Hologram on your product the PK has to be has to be Microsoft and there can only be one PK." I can't believe this doesn't violate some type of anti-trust laws.

How so? The OEMs want to make hardware that runs Windows. Microsoft provides a specification[0] and certification suites[1] that defines what "Windows-compatible" means, which OEMs then follow. Nothing coercive about that.

There is no open standard that defines what a PC is. Linux and other operating systems are piggybacking on the Windows PC standard. If they want OEMs to manufacture hardware to their standards, they'll have to create their own "Linux-compatible" specification and persuade OEMs to follow it.

[0] https://msdn.microsoft.com/windows/hardware/commercialize/de...

[1] https://msdn.microsoft.com/en-us/library/windows/hardware/dn...

>"The OEMs want to make hardware that runs Windows."

I disagree. I think the OEMs want to make hardware that consumer buy. I don't think they care one bit what OS consumers run on top of their hardware. In fact I would imagine OEMS would prefer to bring their products to market without consulting Microsoft at all.

It's coercive in the sense the the secure execution is predicated on there only being one PK and the OEMs have to knuckle under to MS just to be considered a "potential" machine that Microsoft allows to run Windows.

>"Linux and other operating systems are piggybacking on the Windows PC standard."

What exactly is the "Window PC Standard"? I have never heard this term before. Linux didn't piggy back on Windows anything. Maybe you mean X86? X86 predates Windows.

They also want to make hardware that doesn't get them assasinated by the King's agents.

People are calling the old BIOS "PC BIOS" and UEFI "UEFI BIOS" nowadays. So feel free to continue to call it a BIOS.

Some UEFI implementations even call themselves BIOS :-)

I tend to think the SecureBoot isn't really a grand conspiracy. You can't realistically expect end users to be in charge of keys. So MS does what's best for itself. The problem is with poor implementations by vendors that don't support self signing, and in some cases don't even support disabling secure boot.

>"You can't realistically expect end users to be in charge of keys."

Not but the OEM vendors and not MS should be the owner of the sole PK allowed in the engine. MS doesn't make the hardware yet they are in charge of it. I think that's the issue, it has nothing to do with a grand conspiracy.

Is Microsoft mandating all OEMs/hardware vendors to configure secure boot with a MS signing key?

Basically yes; it's required to get the Windows sticker. I haven't heard that MS charges money to sign bootloaders, though.

Thanks, I have to wonder how much of bureaucratic headache that is to get your bootloader signed.

James Bottomley navigated the bureaucracy and lived to tell about it: https://blog.hansenpartnership.com/adventures-in-microsoft-u...

Oh interesting, thanks for the link.

I believe that the Windows 10 logo requirements are exactly the opposite of that.

If you look at the UEFI requirements for Windows 10[1], specifically clauses 19 and 20, it says for non-ARM systems the user MUST be able to put Secure Boot into Custom signature-checking mode.

[1] https://msdn.microsoft.com/windows/hardware/commercialize/de...

They're not opposites. PCs are required to have secure boot and they're required to have MS's cert installed and they're required to be able to disable secure boot.

This was true in Windows 8 times, but with Windows 10 the requirement to be able to turn off Secure Boot vanished: https://arstechnica.com/information-technology/2015/03/windo...

The whole story around Secure Boot could be understood (even without a tinfoil hat) as a part of a slippery slope to lock out alternative OSes, highly recommended post: https://www.phoronix.com/forums/forum/phoronix/general-discu...

> now requires FOSS users to purchase a license from Microsoft to boot FOSS

This isn't actually true, is it?

They charge a fee to get a certificate that you can use to submit binaries to be signed with the Microsoft signing service. If you're a user of a distribution you won't have this problem, because distributions have already paid and have a hack "shim" which effectively enrols the distribution's own keys into the trustdb. But if you wanted to make your own distribution you would have to pay.

Nope. It should be normally possible to disable Secure Boot.

In fact, many distributions don't support Secure Boot at all.

> Nope. It should be normally possible to disable Secure Boot.

This is only true on x86. On arm, Microsoft's requirements state that it should not be possible for users to disable Secure Boot.

But is there any interesting ARM hardware that is certified for Windows? (Honest question, I have no idea.)

For Windows RT, looks like there wasn't that many certified devices.[1]

[1]: https://en.wikipedia.org/wiki/Windows_RT#Devices

Reply on news.ycombinator.com