Linux Foundation waiting for MS to issue UEFI key. :)

[SteveRiley]

Secureboot
Advisory
Board
Overseeing
Testing and
Accreditation and
Government
Endorsement

Wait. Are you actually asking for "government endorsement" of something?

Alright...who the hell are you and what did you do with the real Snowhog?

[tek_heretik]

@Mr. Riley...thank for the kind beating, lol.

[Snowhog]

Yeah, but can I open that nut with any nutcracker, or do I need Secure Nutcracker? And will the food company attempt to block the use of unsigned nutcrackers? If they do, I will lose my temper!

This smacks of a perfect opportunity for SABOTAGE!

Secureboot
Advisory
Board
Overseeing
Testing and
Accreditation and
Government
Endorsement

[bsniadajewski]

Yes, it's possible. UEFI is independent of CPU type.

Good to know that.

I'm looking to (eventually) upgrade the MB/CPU in this thing, hence me wanting to ask.

(And, no, I'm not upgrading to 8 anytime soon, though I may go AMD, probably an Athlon II with a MSI board)

[SteveRiley]

From what I understand, Win8 will work with BIOS-based systems as well as UEFI-based ones. (even those with SB disabled)

Yes, that is correct.

[bsniadajewski]

I'm not an expert, but AFAIK, any machine that comes with Win8 requires a UEFI BIOS. MS requires it for Win8 certification.

Frank.

From what I understand, Win8 will work with BIOS-based systems as well as UEFI-based ones. (even those with SB disabled)

[SteveRiley]

Yeah, but can I open that nut with any nutcracker, or do I need Secure Nutcracker? And will the food company attempt to block the use of unsigned nutcrackers? If they do, I will lose my temper!

[Snowhog]

Hehe.

Some say Ah-monds; some say All-munds.

[SteveRiley]

Folks, the commentary in this thread reflects, unfortunately, quite a number of misunderstandings. It's entirely likely that these comments are summaries of other wrong information many of you have read. Please allow me the opportunity to correct a number of points.

The Linux Foundation has offered a small pre-bootloader as a way around the UEFI problem in Win8 UEFI secured machines. This requires a digital key from MS so that the pre-bootloader can be signed. Guess what? They are still waiting for MS to give them one. Anyone surprised?

I cannot speculate on why the delay exists. There is a technical reason that UEFI appears to require a single ultra-master (my made-up term) signing key, and this has nothing to do with supposed motives. More on that in a moment.

FWIW, a couple of recent laptops that I have purchased have a way to disable the secure boot provision, and revert to 'legacy' BIOS. Both my year old Dell M6600 (Win7), and now this newest Asus X202E (Win8) allow the user to disable the UEFI provisions and load Linux.

As I've said many times: Secure Boot does not equal UEFI and a machine cannot have both BIOS and UEFI. Please take a moment to understand the following:

• The firmware in a machine may be either BIOS or UEFI.
• UEFI includes many more capabilities than BIOS that make UEFI attractive for a variety of reasons.
• Secure Boot is a UEFI feature. It is not all of UEFI. And, it is not required to be enabled.
• UEFI can be placed into BIOS emulation mode. Sometimes this is labled "CSM" or "compatibility service module."

As long as the BIOS makers allow the disabling of UEFI, we are fine. I did find that trying to dual boot with Win8 is complicated. However, if one replaces and/or reformats the drive, the issues disappear.

UEFI cannot be disabled. Remember, two types of firmware: UEFI or BIOS. If you have UEFI, then you can disable Secure Boot. This will simplify the installation of alternate operating systems. Also, formatting a hard drive does not disable Secure Boot.

Never mind reformat, low-level that sucker, lol, and who wants Win (h)8 anyway, lol again.

Similarly, any kind of low-level formatting will have no effect. Matter of fact, the old-style low-level hard drive formatting has not been possible for quite some time now, as modern hard drives use a competely different kind of logical-to-physical sector mapping than the drives of a couple decades ago.

I hope they fix it soon, yes you can disable secure boot for now (who knows how long until the desktops become like the tables and you cannot disable it...) but I fear that this will turn some people away from Linux that just want a simple solution and not have to go messing around in the bios to install an new system.

If this wasn't a ploy my Microsoft to restricted Linux installs then why has it been so hard for LF to get a signed binary and why does it need so much arbitrary Microsoft only tech to get it signed? ... Not that I am trying to create a conspiracy or anything ...

To receive Windows 8 certification, OEMs of X86 hardware are required to provide a mechanism for users to disable Secure Boot. This is clearly stated in the published compliance documentation.

Please pay close attention to the following. If the UEFI specification required that hardware and drivers support multiple master signing keys, then nearly all of the worry about Microsoft lock-in would evaporate. We could have a master Microsoft key for Windows, a master Linux key (if the community agreed on such unification, which is a long shot), a master BSD key, etc. Unfortunately, the specification mandates only a single master signing key. Thus, nearly every firmware, interface card, and driver will therefore be designed to work with the most popular signing key: the one from Microsoft. If J. Random OEM doesn't build in support for Microsoft's key, then J. Random OEM's computer won't run Windows 8 when Secure Boot is enabled. Since Windows 8 accounts for 99.999999% of J. Random OEM's revenue, he's going to do what he has to do to make money.

Actually, I wouldn't be surprised, MS gets away with a lot in the US courts, not so much in Europe, and they bend over backwards for law enforcement, etc, I am starting to think law enforcement, including copyright enforcers hate anything but Windows, I've always said Windows is 'Swiss cheese' for a reason. You actually could be on to something here. That 'key' probably identifies you to both of the aforementioned agencies, they take the machine in, check the key, boom, yer busted. Anti-piracy measure, phht, yeah, right, it's anti-piracy alright, to put us in jail. Big Brother is watching you.

Wrong. There is no individually-idenfiable aspect to Secure Boot. Drivers and kernels and interface cards and firmware all chain to a master signing key. That's all. What you've written here is technically outside the scope of Secure Boot.

I'm not sure that a reformat would work. If secure boot is enabled in the BIOS, does that not prevent the booting of an unsigned OS whether the disk is reformatted or not?

Secure Boot is not possible in BIOS. It is only possible in UEFI. If Secure Boot is enabled, then only drivers, kernels, and hardware that can pass validation will boot. Unsigned software and hardware will not boot. If Secure Boot is disabled, then anything will boot, including signed and unsigned hardware and software.

In any case, with secure boot turned off in the BIOS, I could have reformatted the disk. However, not being certain as to how well this new machine I have (Asus X202E) would work on Linux, I didn't want to do something that would render it unreturnable to the vendor. So, I bought a 256 GB slimline Samsung SSD, and put that in. It formatted ext4 just fine, and I now have a pretty decent netbook with touchscreen running Kubuntu 12.10. The 500 GB HDD with Win8 on it is sitting on my desk, waiting for a new home, and probably a reformat.

Nothing in the license agreement that comes with Windows installed on a machine at the factory requires that Windows still be on the machine if you return the machine to the retailer.

I-don't-think-that-manufacturers-will-make-secure-boot-on-only-they-would-get-way-too-many-complaints. --Forgive-the-dashes-I'm-tracking-a-problem-with-my-installation-of-12.10-and-this-forums-software-in-a-rather-weird-interaction. --I-have-no-ability-to-use-the-space-key-here.

To achieve Windows 8 certification, Secure Boot must be enabled at the factory. Certification also requires that manufacturers expose a mechanism for users to disable Secure Boot. How many more times must this be repeated?

That's the problem. With UEFI a low lever reformat is not possible. IF IT WERE that easy then UEFI wouldn't represent a problem at all.

Again, low-level format is a hard drive thing from many many years ago, not a contemporary motherboard firmware thing.

Oh I see, hmm, liking UEFI less and less everyday, wait a minute, I think I never liked it, before I had no opinion, now I do.

Please take the time to learn the good stuff! UEFI is superior to BIOS because it:

• Removes the limit on primary partitions, thus eliminating the primary/extended partition goofiness
• Does away with complicated and brittle chaining of boot loaders for supporting multiple operating systems
• Provides a programmatic, extensible way of adding firmware features
• Is documented and standardized

Question: DO AMD(-compatible) boards use UEFI or some other form of BIOS?

Yes, it's possible. UEFI is independent of CPU type.

I'm not an expert, but AFAIK, any machine that comes with Win8 requires a UEFI BIOS. MS requires it for Win8 certification.

Previously explained in responses earlier.

[GreyGeek]

I've run into cases where a 6"X6" was necessary to pry the HDD out of the case!

[tek_heretik]

OK What do levers have to do with formatting?

It's tough to remove HDDs from some machines, lol, you have to stick a 4"x4" under it, get the fulcrum in just the right spot, heh.

[Frank616]

Question: DO AMD(-compatible) boards use UEFI or some other form of BIOS?

I'm not an expert, but AFAIK, any machine that comes with Win8 requires a UEFI BIOS. MS requires it for Win8 certification.

Frank.

[bsniadajewski]

That's the problem. With UEFI a low lever reformat is not possible. IF IT WERE that easy then UEFI wouldn't represent a problem at all.

OK What do levers have to do with formatting?

Question: DO AMD(-compatible) boards use UEFI or some other form of BIOS?

[tek_heretik]

That's the problem. With UEFI a low lever reformat is not possible. IF IT WERE that easy then UEFI wouldn't represent a problem at all.

Oh I see, hmm, liking UEFI less and less everyday, wait a minute, I think I never liked it, before I had no opinion, now I do.

[GreyGeek]

Never mind reformat, low-level that sucker, lol, and who wants Win (h)8 anyway, lol again.

That's the problem. With UEFI a low lever reformat is not possible. IF IT WERE that easy then UEFI wouldn't represent a problem at all.