Secure Boot/en: Difference between revisions

Line 3:

Secure Boot has multiple implementations, the most well known one is UEFI Secure Boot, which relies on the UEFI platform firmware, but other implementations can exist on embedded systems.

~~On NixOS, Secure Boot can be enabled using the [[Lanzaboote]] or [[Limine]] projects.~~

~~It is recommended to set a BIOS password and enable full disc encryption to prevent attacks which can bypass Secure Boot.~~

[[Category:Security]]

Line 23:

Line 19:

...

</syntaxhighlight>The system above has secure boot enabled and enforced. Other values include <code>disabled (setup)</code> for Setup Mode, <code>disabled (disabled)</code> or <code>disabled (unsupported)</code>. The unsupported tag only appears if your device firmware does not support Secure Boot at all.

If you see <code>disabled (disabled)</code>, this means you will need to enable Secure Boot in your UEFI firmware settings before proceeding to use one of the projects outlined ~~here~~.

If you see <code>disabled (disabled)</code>, this means you will need to enable Secure Boot in your UEFI firmware settings before proceeding to use one of the projects outlined below.

== Enabling Secure Boot on NixOS ==

On NixOS, there are currently two main ways to enable Secure Boot, [[Lanzaboote]] and [[Limine]]. See their respective wiki pages for step by step instructions on each.

For Secure Boot to be most effective, there are certain conditions which should also be met. The most important are:

# The UEFI firmware is protected by a strong password to prevent an untrusted drive from being booted or Secure Boot being disabled.

# Full disk encryption is enabled so that your drive cannot simply be read by putting it another another machine.

# Ideally, default OEM/third party keys are not in use as these have been shown to weaken the security of Secure Boot significantly.<ref>https://habr.com/ru/articles/446238/</ref> However, this may brick some devices which use Microsoft-signed OpROMS for certain hardware during the boot process, particularly some laptops, so you must be certain before removing them. It may be impossible to fix if, for example, the GPU relies on these OpROMS.

== See Also ==

[https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot Arch Wiki/Secure Boot] Extensive information on Secure Boot including using UKIs.

@@ Line 3: / Line 3: @@
 Secure Boot has multiple implementations, the most well known one is UEFI Secure Boot, which relies on the UEFI platform firmware, but other implementations can exist on embedded systems.
-On NixOS, Secure Boot can be enabled using the [[Lanzaboote]] or [[Limine]] projects.
-It is recommended to set a BIOS password and enable full disc encryption to prevent attacks which can bypass Secure Boot.
 [[Category:Security]]
@@ Line 23: / Line 19: @@
 ...
 </syntaxhighlight>The system above has secure boot enabled and enforced. Other values include <code>disabled (setup)</code> for Setup Mode, <code>disabled (disabled)</code> or <code>disabled (unsupported)</code>. The unsupported tag only appears if your device firmware does not support Secure Boot at all.
-If you see <code>disabled (disabled)</code>, this means you will need to enable Secure Boot in your UEFI firmware settings before proceeding to use one of the projects outlined here.
+If you see <code>disabled (disabled)</code>, this means you will need to enable Secure Boot in your UEFI firmware settings before proceeding to use one of the projects outlined below.
+== Enabling Secure Boot on NixOS ==
+On NixOS, there are currently two main ways to enable Secure Boot, [[Lanzaboote]] and [[Limine]]. See their respective wiki pages for step by step instructions on each.
+For Secure Boot to be most effective, there are certain conditions which should also be met. The most important are:
+# The UEFI firmware is protected by a strong password to prevent an untrusted drive from being booted or Secure Boot being disabled.
+# Full disk encryption is enabled so that your drive cannot simply be read by putting it another another machine.
+# Ideally, default OEM/third party keys are not in use as these have been shown to weaken the security of Secure Boot significantly.<ref>https://habr.com/ru/articles/446238/</ref> However, this may brick some devices which use Microsoft-signed OpROMS for certain hardware during the boot process, particularly some laptops, so you must be certain before removing them. It may be impossible to fix if, for example, the GPU relies on these OpROMS.
+== See Also ==
+[https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot Arch Wiki/Secure Boot] Extensive information on Secure Boot including using UKIs.
+<references />