• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

Secure Boot Questions

bigdogchris

bigdogchris

Fully [H]
Joined
Feb 19, 2008
Messages
19,079
After reading this thread, I found I had some questions regarding Secure Boot.

If you have a retail Windows 8 certified motherboard that has the Secure Boot feature, can you enable it and install Windows 8 from retail media and be able to use Secure Boot? For some reason I was under the impression that Secure Boot was something that only OEM's had access to and had to enable.

Also, I read the the OS loader needs to be signed to enable Secure Boot. What are the actual files that are signed for Windows (winload.exe)?

Finally, is it completely up to the OS manufacturer to sign according to the Secure Boot on the motherboard? How else would the motherboard key and OS keys be updated to match?
 
Secure Boot as I understand it is a protection feature to prevent malware from inserting itself into the code during the startup sequence. It is not a service for making the OS legitimate, all it does is detects corruption in the startup sequence. It can be user enabled and disabled on x86 systems, and is not limited to Windows 8. As I recall, several Linux distros were able to obtain signed keys from Microsoft for Secure Boot, and are working on actually integrating the Secure Boot features into their distros, as all the keys do is tell Secure Boot that it is okay to let it boot, but does not add extra security.
 
Secure boot keys are part of the BIOS. If you use secure boot you might consider replacing them with your own keys. Here's what the PK cert which comes on my Z77 says.

5742d1364286128-z77-pro3-raid-uefi-setup-bios-dnt.png


Still, since I have found secure boot can be turned off from within Windows itself it seems it is a pretty useless feature to me and more of an inconvenience. For full UEFI booting it's winload.efi not exe, also the efi boot manager on the FAT32 ESP partition.
 
I think what you probably want to know, is that Secure Boot is mostly automatic with Windows 8. You enable it in the UEFI BIOS of your motherboard, then Windows is all set up already you just need to install (to GPT I believe), you don't have to do anything else. It just checks, as has been said, that nothing in the boot sequence (device ROMs like GPU etc., and Windows boot files) have been tampered with. To enable it on my motherboard (P9X79 WS), I had to load the default keys which are already in the UEFI BIOS. I also disabled CSM in there, CSM enabled will allow non-UEFI devices (such as older video cards) to work with secure boot, but with reduced security since those devices can not be guaranteed unmodified, ideally you want CSM disabled for max security, which I can do with my GTX 780 but could not do with my old GTX 580 as according to EVGA the rom chip on that GPU did not have enough room for a UEFI BIOS. I think GTX 600 series requires a special rom update from the company, while the 700 series already has it installed by default. Not sure about AMD stuff.
 
I guess what my main question is, as new versions of Windows come out (8.1, etc), do the OSes have to match the certificate in the motherboard or will the motherboards EFI need to be updated with new certificates?
 
I believe the keys will be the same, so there should be no update required.
 
You must log in or register to reply here.
Back
Top