Free Republic
Browse · Search
Topics · Post Article

Skip to comments.

Red Hat engineer renews attack on Windows 8-certified secure boot
The Register ^ | 26 September 2011 | John Leyden

Posted on 09/27/2011 8:25:02 AM PDT by ShadowAce

A senior Red Hat engineer has lashed back at Microsoft's attempt to downplay concerns that upcoming secure boot features will make it impossible to install Linux on Windows 8 certified systems.

Unified Extensible Firmware Interface (UEFI) specifications are designed to offer faster boot times and improved security over current BIOS ROM systems. The secure boot feature of the specification is designed so that only digitally signed OS loaders will load, a security feature that would prevent the installation of generic copies of Linux or FreeBSD as well as preventing rootkits and other boot-time malware from running.

A digitally signed build of Linux would work, but that would mean persuading OEMs to include the keys. Disabling the feature would allow unsigned code to run. However, it is unclear how many OEMs and firmware vendors will follow this route, which isn't required for Windows 8 certification.

The forthcoming secure boot feature has created a huge row with computer scientists, such as Ross Anderson of Cambridge University (here), and open-source developers who accuse Microsoft of pushing lock-in and decreasing consumer choice. Microsoft responded by saying consumers would continue to control their PC and cited the example of one OEM, Samsung, which is including a "disable secure boot" feature on prototype versions of its tablet PC.

Power play

This response has failed to satisfy critics of the technology. Matthew Garrett, power management and mobile Linux developer at Red Hat, who was among the first to flag up concerns over the technology, said that Microsoft's response fails to address his central point that "Windows 8 certified systems will make it either more difficult or impossible to install alternative operating systems".

Red Hat, he explains, has been working with Linux suppliers, hardware manufacturers and BIOS developers since becoming aware of the issue in early August.

Garrett said that Windows 8 certification requires that hardware ship with UEFI secure boot enabled. A feature allowing secure boot to be disabled – necessary to run Linux and FreeBSD on certified systems – is not required for certification. "We've already been informed by hardware vendors that some hardware will not have this option," Garrett writes in a flow-up blog post to his original critique of the technology.

In addition, Windows 8 certification does not require that the system ship with any keys other than Microsoft's. Such systems will only securely boot Microsoft operating systems.

A system that ships with Microsoft's signing keys and no others will be unable to perform secure boot of any operating system other than Microsoft's," Garrett writes. "No other vendor has the same position of power over the hardware vendors. Red Hat is unable to ensure that every OEM carries their signing key. Nor is Canonical. Nor is Nvidia, or AMD or any other PC component manufacturer."

Neither of the two options – the first being to get OEMs to include keys for a digitally signed copy of a particular build of Linux and the second being allowing users to disable secure boot – look likely in most circumstances. The upshot of this, as things stand, is that Linux fans will only be able to run the alternative operating system on a small minority of Windows 8-certified hardware.


But the issue goes beyond operating system choices and also affects other modification a user might choose to make to their PC, Garrett argues. He reckons Microsoft is pushing control of what can or can't be done on a PC away from consumers towards hardware manufacturers.

"Microsoft claims that the customer is in control of their PC," he writes. "That's true, if by 'customer' they mean 'hardware manufacturer'. The end user is not guaranteed the ability to install extra signing keys in order to securely boot the operating system of their choice. The end user is not guaranteed the ability to disable this functionality. The end user is not guaranteed that their system will include the signing keys that would be required for them to swap their graphics card for one from another vendor, or replace their network card and still be able to netboot, or install a newer SATA controller and have it recognise their hard drive in the firmware. The end user is no longer in control of their PC."

Garrett isn't opposed to secure boot or UEFI as such but the way Microsoft is "misusing" the technology to "gain tighter control" over the desktop operating system market it already dominates.

"Microsoft's rebuttal is entirely factually accurate," Garrett writes. "But it's also misleading. The truth is that Microsoft's move removes control from the end user and places it in the hands of Microsoft and the hardware vendors. The truth is that it makes it more difficult to run anything other than Windows. The truth is that UEFI secure boot is a valuable and worthwhile feature that Microsoft are misusing to gain tighter control over the market. And the truth is that Microsoft haven't even attempted to argue otherwise," he concludes. ®

Boot(ing-up) Note

Red Hat has done some testing work with the UEFI Forum, an industry group that is overseeing the development and introduction of the next-generation start-up specification. However this testing work happened before the implications of the secure boot feature became clear, Garrett told El Reg.

We're contributing members of the UEFI forum, which means we have access to the specification drafts and contribute towards the language in them," Garrett told El Reg. "We also typically attend some of the UEFI testing events. While the UEFI specification for secure boot has been public for some time, Microsoft's plans for it only became known very recently. We're still at the point of working out how some of the fine details are going to work. So, yes, while we do some testing with the forum, the last testing event was from before Microsoft let us know they were going to do this." ®

TOPICS: Computers/Internet
KEYWORDS: linux; microsoft; uefi
Navigation: use the links below to view more comments.
first previous 1-2021-32 last
To: ShadowAce

Smells to high heaven, IMO.

If I build my own, will I be forced to buy a motherboard that is crippled?

21 posted on 09/27/2011 9:25:03 AM PDT by ChildOfThe60s ( If you can remember the weren't really there)
[ Post Reply | Private Reply | To 1 | View Replies]

To: Texas Fossil
That statement is from the perspective of Microsoft single handed direction of the PC development.


That statement was from the perspective of doing a comparative assesment of the affects of a business model that leaves hardware development to the hardware manufacturers and trying to write the OS to support as much of that as possible, vs a business model of writing an OS designed for a limited hardware platform controlled and manufactured by the company writing the OS.

22 posted on 09/27/2011 9:42:28 AM PDT by tacticalogic
[ Post Reply | Private Reply | To 19 | View Replies]

To: tacticalogic

when in doubt, accuse MS ..

23 posted on 09/27/2011 9:47:03 AM PDT by RitchieAprile
[ Post Reply | Private Reply | To 13 | View Replies]

To: tacticalogic
Oh, I misunderstood. You were talking about the Apple model, not Linux.

MS was never a hardware developer, so why would they? In the case of Apple, until recently they always had ties to hardware and software.

MS is increasingly trying to force the hardware manufacturers and PC assemblers to enforce their licensing. To the point of trying to hold the U.S. manufacturers responsible for their ChiCom hardware suppliers. They recently had defectors on that attempt.

Since we are on the subject. There is a reason that hardware, operating systems and applications were developed separately. The complexity and the skills were dispersed. Openness allowed all this to happen.

24 posted on 09/27/2011 9:56:26 AM PDT by Texas Fossil (Government, even in its best state is but a necessary evil; in its worst state an intolerable one)
[ Post Reply | Private Reply | To 22 | View Replies]

To: tacticalogic

Oh, and I forgot. There were also the BIOS guys.

25 posted on 09/27/2011 9:57:32 AM PDT by Texas Fossil (Government, even in its best state is but a necessary evil; in its worst state an intolerable one)
[ Post Reply | Private Reply | To 22 | View Replies]

To: Texas Fossil

If you were in charge of license enforcement, how would you do it?

26 posted on 09/27/2011 10:29:24 AM PDT by tacticalogic
[ Post Reply | Private Reply | To 24 | View Replies]

To: ShadowAce

will be unable to perform secure boot of any operating system other than Microsoft’s

Will be unable to perform *secure* boot or unable to perform *any* boot?

27 posted on 09/27/2011 10:45:23 AM PDT by 2 Kool 2 Be 4-Gotten
[ Post Reply | Private Reply | To 1 | View Replies]

To: Texas Fossil
Oh, and I forgot. There were also the BIOS guys.

IIRC, it was compaq that originally reverse engineered BIOS in a clean-room environment. Without access to BIOS routines, we would have been fooked.

28 posted on 09/27/2011 11:38:26 AM PDT by zeugma (Those of us who work for a living are outnumbered by those who vote for a living.)
[ Post Reply | Private Reply | To 25 | View Replies]

To: 2 Kool 2 Be 4-Gotten
Will be unable to perform *secure* boot or unable to perform *any* boot?

As I understand the situation, it will be able to perform a *secure* boot of any signed OS that has the matching keys installed in the firmware.

If the motherboard manufacturer doesn't give you the option to enable a non-secure boot, then you won't be able to boot an unsigned OS, or signed OS that the firmware doesn't have the keys to validate.

I've also seen some discussion about the motherboard manufacturers providing the ability to update the installed keys in the firmware. With this option, you should be able to obtain a generic copy of a Linux (or any other OS) distro, sign it, and install the keys for cert into the firmware and then do a *secure* boot of that OS.

At this point claiming that this will prevent you from ever booting anything but Windows on a Windows PC appears to be FUD. It's possible that a manufacturer could design and ship a motherboard that only has the Windows keys installed, doesn't allow you to select the option of doing a non-secure boot, and doesn't have any provisions for updating the key collection. I'll leave it to you to speculate on the probability that a manufacturer would intentionally paint themselves into that corner.

29 posted on 09/27/2011 12:31:04 PM PDT by tacticalogic
[ Post Reply | Private Reply | To 27 | View Replies]


Ms OS sequence:
Poor: 3.x, 95, 98, ME, Vista

Solid: NT, 2000, XP, W7/64

IMHO, W8 has all chances to follow along ME and Vista.

Don’t know if you left it out deliberately or not, but Win98SE was an excellent OS.

30 posted on 09/27/2011 3:30:06 PM PDT by chaosagent (Remember, no matter how you slice it, forbidden fruit still tastes the sweetest!)
[ Post Reply | Private Reply | To 20 | View Replies]

To: tacticalogic

Thanks for the interesting and thoughtful response. Sounds like you understand the problem domain as well as most in the industry, maybe better. Sounds like the industry hasn’t quite figured out where everything is going to land on this one. Will definitely keep an eye out. Thanks again.

31 posted on 09/27/2011 5:23:34 PM PDT by 2 Kool 2 Be 4-Gotten
[ Post Reply | Private Reply | To 29 | View Replies]

To: Halfmanhalfamazing
Apple’s OSs have typically been much more............. bossy........ than Microsoft’s. Until recently. MS wants to end this before it gets any worse.

Apple computers may have still made computers a commodity, but this sort of strong arm tactic is one that Apple would’ve employed long, long ago. IMHO.

Although Apple in the interregnum between Jobs eras did license its OS for non-Apple hardware, under Jobs Apple has not so much sold licenses to OS X but has bundled OS X with its hardware - and refused to license OS X use on any other hardware.
Apple would prefer a hardware feature which enabled OS X and which was unique to Apple to a technology which prevented other OSes from running on Apple hardware.
To the extent that Microsoft could undermine the production of hardware by independent OEM's which ran on any other OS than Windows, it would throw Apple - producer of its own hardware - directly into the briar patch. In that world, Hackintoshes wouldn't exist - and Apple's business model depends on the active desire of customers for OS X.
Of course in the smartphone realm, Apple does oppose the "unlocking" of hardware.

32 posted on 09/28/2011 5:08:49 AM PDT by conservatism_IS_compassion (DRAFT PALIN)
[ Post Reply | Private Reply | To 14 | View Replies]

Navigation: use the links below to view more comments.
first previous 1-2021-32 last

Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.

Free Republic
Browse · Search
Topics · Post Article

FreeRepublic, LLC, PO BOX 9771, FRESNO, CA 93794 is powered by software copyright 2000-2008 John Robinson