Advanced

Why some Windows 8 machines might not be able to boot Linux

Posted by scan2006 on · 3 comments
mjg59's journal; By Matthew Garrett
Mail this story
Print this story

The UEFI secure boot protocol is part of recent UEFI specification releases. It permits one or more signing keys to be installed into a system firmware. Once enabled, secure boot prevents executables or drivers from being loaded unless they're signed by one of these keys. Another set of keys (Pkek) permits communication between an OS and the firmware. An OS with a Pkek matching that installed in the firmware may add additional keys to the whitelist. Alternatively, it may add keys to a blacklist. Binaries signed with a blacklisted key will not load.

Full Story

  Nav
» Read more about: Story Type: Newsletter; Groups: Linux, Red Hat

» Get new stories by e-mail: nightly or as they are published

« Return to the newswire homepage

  Related stories
» More like this

Comments (3)

Microsoft isn't thinking this through. Both options of signing (MS Masterkey or OEM signing) have significant ramifications.

If MS chooses to go the MS Masterkey route and only have one key, it will be only a matter of time before that key is cracked/leaked/channeled from the great beyond and all binaries will once again run everywhere, even if the UEFI "Tivo module" can't be shut down. Lots of effort, no effect.

If MS chooses to go separate signing keys for every Windows version, it's going to be very messy. You've got Windows 8 Premium OEM, but want to install your Windows 7 Home retail licensed copy? Either MS has to provide you with a (Windows 8 key) signed Windows 7 Home retail licensed copy or tell you to just buy another computer. A new version appears? Either buy a new computer or once again a separate (Windows 8 key) signed Windows 9 copy. This scheme would certainly kill retail boxes.

If MS chooses to let OEMs do the signing... Run for the hills. Computers then really become welded shut appliances. As soon as the model you bought isn't manufactured anymore and support is EOL-ed, you're up the creek.

Whatever the scheme, costumers will be negatively impacted. This won't last long. Once the realisation sets in that the thing you just bought is a glorified toaster, only capable of running that one provided OS and providing no hassle free operation or upgrade path, the outrage will dwarf the one over Intel's processor serial number.

Also, coupling Windows with technical measures to a general purpose computer reeks a lot like illegal tying. I wonder what competition authorities have to say about that.
Quoting:You've got Windows 8 Premium OEM, but want to install your Windows 7 Home retail licensed copy?
After people refused the Vista "upgrade" and insisted on staying with XP, Ballmer et al. are probably eager to avoid a replay of that debacle.

Of course, this debacle might make that one look like a minor technical glitch by comparison.
Quoting:If a vendor key is installed on a machine, the only way to get code signed with that key is to get the vendor to perform the signing.


That means the customers no longer have control over their purchased hardware. That means customers don't fully own the hardware and only has a one time lease payment.

It sounds like "you're either with us, or against us". I say let them do that and see where it is going to take them.

This setup will probably work for MS in the US, but I surely doubt it will work in other countries. If the US OEMs go along, there are other international OEMs who will be willing to supply computers with or without UEFI secure boot protocol. This will eventually marginalize the OEMs in The US internationally.



Post a comment

A free account is needed to post. Write your comment here first: your text is kept in this browser while you sign up or log in, and is waiting for you when you come back.

Your message:
|||||
10
Markdown: **bold**, *italic*, [text](https://link), - lists, > quotes, $x^2$ for math. Formatting help

Sign up and post (it is free)  or  Log in and post