Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Measured boot and secure storage of keys. It's not all bad.


That's good to hear then! So will most computers having a TPM chip lead to easier integration of secure boot with i.e. linux distros as well?


As long as most computers ship in a manner where the owner can adjust the keys in TPM/SecureBoot - you could argue its a good thing.

Eg,like: https://ubuntu.com/blog/how-to-sign-things-for-secure-boot


I had to disable secure boot to get Nvidia's drivers to work. So I guess the end result might be more hardware trouble for distros, with a subsystem that tries to prevent usage of the computer when it is not happy.


You can also enroll your MOK (Machine-Owner-Key) to UEFI and then sign the nvidia driver with it.

That way, you can leave Secure Boot enabled. However, leaving the secret part of MOK on the machine and let the dkms or whatever updater of kernel modules to use it unattended kind of defeats the purpose.


Is the NVIDIA driver already signed? If it is, couldn't you create a certificate signed with the root key that says that the NVIDIA key is trusted?


No, last time I used it, it was object file and source for a shim. You had to build the shim for your specific kernel and link together with the supplied object file. The result is kernel module, that is unsigned because it is you who built it.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: