MX Linux Forum

Secure Boot is mostly a mess, IMO, because the key management sucks so badly that nobody (statistically speaking!) even tries to manage their own keys. Instead, everyone relies on Microsoft's keys shipping with the system and Microsoft signing the boot loader (or shim).

If the install process for other OSs could also safely and reliably enroll their own keys and sign their own distributions, Microsoft could just stick to their own business.

On Thursday, researchers from security firm Binarly revealed that Secure Boot is completely compromised on more than 200 device models sold by Acer, Dell, Gigabyte, Intel, and Supermicro. The cause: a cryptographic key underpinning Secure Boot on those models that was compromised in 2022. In a public GitHub repository committed in December of that year, someone working for multiple US-based device manufacturers published what’s known as a platform key, the cryptographic key that forms the root-of-trust anchor between the hardware device and the firmware that runs on it.