Feeds

MS denies secure boot will exclude Linux

Lock-out security tech can be disabled, if OEMs want

Providing a secure and efficient Helpdesk

Microsoft has hit back at concerns that secure boot technology in UEFI firmware could lock out Linux from Windows 8 PCs, saying that consumers will be free to run whatever they want on their PCs.

Unified Extensible Firmware Interface (UEFI) specifications, designed to reduce start-up times and improve security, allow computers to verify digitally signed OS loaders before booting. The feature in UEFI, the successor to BIOS ROM, is designed as a countermeasure against rootkits and other bootloader nasties.

However computer scientists, including Professor Ross Anderson of Cambridge University, warned earlier this week that the approach would make it impossible to run "unauthorised" OSes such as Linux and FreeBSD on PCs. A signed build of Linux would work, but that would mean persuading OEMs to include the keys.

In addition since the kernel itself is part of the boot process, kernels will also have to be signed, a huge bureaucratic hurdle for developers that runs wholly against the grain of open source software development, as explained in more depth by tech blogger Matthew Garrett here.

If the draft for UEFI is adopted without modification, then systems with secure boot enabled simply will not run a generic copy of Linux. Disabling the feature would allow unsigned code to run. However Garrett argues that since "firmware vendors and OEMs are interested in providing only the minimum of firmware functionality required for their market" this may not be possible, a concern shared by Anderson.

"The extension of Microsoft’s OS monopoly to hardware would be a disaster, with increased lock-in, decreased consumer choice and lack of space to innovate," he said. Anderson concludes that the approach is even worse than previous attempts to force feed Windows users with DRM technology.

In a blog post on Thursday, Microsoft attempted to address these concerns arguing that "complete control over the PC continues to be available" to consumers.

Secure boot is a UEFI protocol, rather than a specific Windows 8 feature, and "Microsoft does not mandate or control the settings on PC firmware that control or enable secured boot from any operating system other than Windows," Microsoft's Tony Mangefeste explains.

"Secure boot doesn’t 'lock out' operating system loaders, but it is a policy that allows firmware to validate authenticity of components. OEMs have the ability to customize their firmware to meet the needs of their customers by customizing the level of certificate and policy management on their platform," he adds.

Mangefeste cites the example of a prototype Samsung tablet with firmware designed to allow customers to disable secure boot, an option that is open to OEMs.

Just how many OEMs will take this approach remains unclear. Microsoft has effectively batted the question over to its hardware partners and firmware suppliers. What both Microsoft and critics of UEFI seemingly agree on is that unless secure boot can be disabled then Linux can't be run on Windows 8 PCs.

We asked the UEFI Forum to comment on the issue earlier this week but are yet to hear back from the industry group, which promotes and manages the UEFI standard. Members of the UEFI forum include Apple, IBM and BIOS giant Phoenix Technologies as well as Microsoft. ®

Internet Security Threat Report 2014

More from The Register

next story
Microsoft WINDOWS 10: Seven ATE Nine. Or Eight did really
Windows NEIN skipped, tech preview due out on Wednesday
Business is back, baby! Hasta la VISTA, Win 8... Oh, yeah, Windows 9
Forget touchscreen millennials, Microsoft goes for mouse crowd
Apple: SO sorry for the iOS 8.0.1 UPDATE BUNGLE HORROR
Apple kills 'upgrade'. Hey, Microsoft. You sure you want to be like these guys?
ARM gives Internet of Things a piece of its mind – the Cortex-M7
32-bit core packs some DSP for VIP IoT CPU LOL
Microsoft on the Threshold of a new name for Windows next week
Rebranded OS reportedly set to be flung open by Redmond
Lotus Notes inventor Ozzie invents app to talk to people on your phone
Imagine that. Startup floats with voice collab app for Win iPhone
'Google is NOT the gatekeeper to the web, as some claim'
Plus: 'Pretty sure iOS 8.0.2 will just turn the iPhone into a fax machine'
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.