UEFI Secure Boot

Simple Definition for Beginners:

UEFI Secure Boot is a security feature in modern computers that ensures only trusted software is loaded during the boot process, protecting the system from malicious attacks.

Common Use Example:

When a computer with UEFI Secure Boot enabled starts up, it checks the digital signatures of bootloader and operating system files to verify their authenticity, preventing unauthorized software from running.

Technical Definition for Professionals:

UEFI Secure Boot is a security mechanism implemented in Unified Extensible Firmware Interface (UEFI) firmware that validates the digital signatures of bootloader and OS components before they are executed during the boot process. Key aspects of UEFI Secure Boot include:

• Digital Signature Verification: Checking the cryptographic signatures of bootloader (boot manager) and OS files to ensure they are signed by trusted authorities.
• Chain of Trust: Establishing a secure chain of trust from firmware to bootloader to OS components, preventing tampering with critical system software.
• Platform Key (PK): The root of trust in UEFI Secure Boot, used to sign and validate the keys of bootloader and OS components.
• Key Exchange and Enrollment: Managing cryptographic keys and certificates for secure boot operations, including key enrollment and revocation.
• Secure Boot Policy: Configuring and enforcing policies for secure boot operations, such as allowed signature types and enforcement levels.