Secure boot
Also known as: UEFI Secure Boot
A start-up check that lets a computer run only boot software and a kernel carrying a trusted digital signature.
Draft - this entry has not been reviewed yet.
Formal
A chain of checks at start-up. The machine's built-in start-up software checks the digital signature of each start-up program and add-on driver against keys stored in the machine, and the signed start-up program then checks the kernel; any failed check stops the start.
In plain English
Like a guard at the factory gate who checks every driver's badge before the working day starts, so nobody can slip in while the lights are still off.
In practice
A municipality gets laptops back from an outside repair shop. One refuses to start and shows a secure boot warning because its start-up program has been swapped, so IT takes it out of use and investigates.
Why it matters
Malware that loads before the operating system can hide from every protection that starts later, so the only safe place to stop it is at the very first step.
Technical deep dive
UEFI Secure Boot was introduced in UEFI 2.3.1 (Errata C, 2011) and became mainstream with Windows 8 certification in 2012. Its policy lives in authenticated UEFI variables: the Platform Key (PK), normally owned by the OEM, authorises updates to the Key Exchange Key database (KEK); KEK entries authorise updates to the signature database db (allowed certificates and hashes) and the forbidden database dbx (revoked certificates and hashes). Before executing any UEFI image, including boot loaders, drivers and option ROMs on add-in cards, the firmware verifies its Authenticode signature against db and checks that neither the image hash nor the signer appears in dbx. The chain then continues in software: Windows Boot Manager verifies winload and the kernel, while Linux distributions use a small shim signed by Microsoft's third-party UEFI CA, which embeds the distribution's own key and verifies GRUB and the kernel, with MOK (Machine Owner Key) letting administrators enrol their own keys.
Secure Boot only enforces "signed by a trusted key"; it does not record what ran. Measured boot is the complement: each stage hashes the next into TPM Platform Configuration Registers (PCRs 0-7 for firmware and boot configuration), producing a log that can be attested remotely or used to seal disk-encryption keys, as BitLocker and systemd-cryptenroll do. Neither mechanism protects against compromise of the firmware itself, which is the domain of NIST SP 800-193 platform firmware resiliency and hardware roots of trust such as Intel Boot Guard.
The weak point is revocation. A signed but vulnerable boot component can be replayed forever unless its hash or certificate is added to dbx, and dbx has limited storage. BootHole (CVE-2020-10713) in GRUB2 and the BlackLotus bootkit, which exploited CVE-2022-21894 in Windows Boot Manager and was the first publicly known malware bypassing Secure Boot on fully patched Windows 11 (2023), required mass dbx updates and, for BlackLotus, a staged Microsoft mitigation under CVE-2023-24932. PKfail (2024) showed that hundreds of device models shipped with a test Platform Key whose private key had leaked, making Secure Boot on them bypassable.
Key expiry is the current operational issue. Microsoft's original 2011 certificates run out during 2026: the Microsoft Corporation KEK CA 2011 and the Microsoft UEFI CA 2011 expired in June 2026, and the Windows Production PCA 2011 that signs the Windows boot manager expires on 19 October 2026. Devices must receive the 2023 replacement certificates in KEK and db (through Windows updates or OEM firmware) to keep receiving boot-component and dbx updates. Secure Boot can also be disabled or put into setup mode in firmware settings by anyone with physical access unless a firmware password is set, and it does nothing against attacks that start after the kernel has loaded. It should not be confused with Trusted Boot or with signed kernel modules, which extend verification later into the OS.
What to learn first
Everything this builds on, foundations first.
Relationships
Sources & further reading
Standards & official texts
Official documentation
Where this data comes from
This entry was drafted by an AI from the sources above and has not yet been checked by a person. Treat it as a starting point, and check anything important against the sources.
See the review queueSuggest a correction on GitHubThis term as JSON
Check yourself
Loading…