Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

What exactly is Windows supposed to verify? There isn’t a standard PCR with some standard value indicating that a certain image was booted.

DRTM is a credible (sort of) alternative, but at that point Secure Boot isn’t really necessary — the whole point of DRTM is that you verify the current state of the system, not how it got there.



> There isn’t a standard PCR with some standard value indicating that a certain image was booted.

No, but there is a standard PCR with a standard value indicating that a certain certificate was used to sign what was booted, and Windows is signed with its own certificate rather than the third party UEFI CA one.


Nice, so MS gets better TPM-based assurance than anyone else.


Well, shim also measures whatever certs it uses, so it's not a complete loss.


But if anything other than shim, but signed by the same key, is used, then there’s no way to detect that, right?


Correct.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: