On Thu, Oct 3, 2019 at 10:29 PM Clay Daniels Jr. wrote:> Just whose secure keys do you suggest? I go to a lot of trouble to disable secure boot so I can load any operating system I want.The goal would be not to disable secure boot and have FreeBSD running with a secured bootloader :-) At the moment we have insecure boot + insecure kernel + possible encrypted data partition.. -- CeDeROM, SQ7MHZ, http://www.tomek.cedro.info
>> Just whose secure keys do you suggest? I go to a lot of trouble to disable >> secure boot so I can load any operating system I want.Some motherboards have BIOS that allows you to both - Upload your own keys - Delete all the spooky Microsoft keys Read the UEFI Secure Boot specification document. Then paste all the key management specs into a ticket with your motherboard vendor and get on them to publish a BIOS release that has proper key management functions. Some BIOS makers have this as selectable options in their BIOS reference build routines... ie: the motherboard maker doesn't have to write any code, they just point and click, and the option appears in a BIOS release for mobo end user customers. Sometimes you have to bug and escalate the mobo makers and threaten to walk your next purchase to another mobo maker to get them to cut and post the new BIOS release. https://www.uefi.org/ https://uefi.org/learning_center/papers https://uefi.org/specsandtesttools https://uefi.org/sites/default/files/resources/UEFI_Spec_2_8_final.pdf https://uefi.org/sites/default/files/resources/UEFI_Secure_Boot_in_Modern_Computer_Security_Solutions_2019.pdf https://uefi.org/sites/default/files/resources/UEFI%20Forum%20White%20Paper%20-%20Chain%20of%20Trust%20Introduction_2019.pdf> The goal would be not to disable secure boot and have FreeBSD running > with a secured bootloader :-) > > At the moment we have insecure boot + insecure kernel + possible > encrypted data partition..> would be really nice also to get UEFI BOOT compatible with SECURE BOOT :-)Yes.