On Thu, Jun 7, 2012 at 11:05 PM, Miles Bader <mi...@gnu.org> wrote: > "Christofer C. Bell" <christofer.c.b...@gmail.com> writes: >>> Would that mean anybody who wants to build their own kernel would need >>> to buy a signing key? >> >> Not at all. You can generate your own key and load it into your UEFI. >> It's no different a situation than using self-signed ssl certs >> without buying one from a certificate authority. There's no need to >> pay any money to anyone to use the secure boot feature. Is it a >> hassle? Sure, but you're not beholden to any 3rd party regardless. > > Er, wait, doesn't that mean a malware author could do the same thing?
Yes, any malware author would be able to generate a signing key and sign their software as authentic genuine malware. This does not mean that you are compelled to trust that key. > Or is entering a new key a "manual" process ("type in the 50 hex digit > key")? You would need to enter that key yourself into your UEFI indicating that you trust the malware author's key. If you do not enter it into your system, you indicate that you do not trust the key and therefore the malware will not be allowed to run on your machine. > Can there be multiple keys (I vaguely recall the article saying there > could only be one key [at MS's insistence]...but not sure if I really > understood what it was saying)? That depends on the UEFI implementation. I would guess that mutliple keys are possible. -- Chris -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/caoevnys2gpjoplfjj8ajcohubnmcyna_1fw_tmqyon3zehm...@mail.gmail.com