Understand UEFI Secure Boot and Chain of Trust

UEFI Secure Boot and trust

Secure Boot uses firmware-stored keys to verify each boot stage before execution. The platform key (PK), key-exchange keys (KEK), and signature databases (db/dbx) form a chain of trust from power-on to the OS loader. For example, a shim bootloader signed by a CA in db can load a Linux kernel only if the kernel's signing certificate is also trusted.

Chain of trust stages

1. Firmware: Verifies its own integrity (often via hardware roots like TPM)
2. EFI application: Boot loader .efi must carry a valid Authenticode signature
3. Kernel / initrd: Optional enforcement via kernel lockdown and signed modules
4. Revocation: dbx blocks known-bad hashes and certificates

cCopy
Loading…

• Microsoft KEK is preinstalled on most retail PCs; Linux uses shim + MOK
• Disabling Secure Boot is a firmware setup option, not a runtime API
• Measured boot (TPM PCRs) extends trust into the running OS

Why for this exercise

You will document how Secure Boot keys and signatures gate each loader stage. This exercise requires explaining PK, KEK, db, and dbx and how a signed .efi binary is accepted or rejected at boot.