Linux and Secure Boot certificate expiration

Post by CaliforniaKarl » Sat, Jul 19, 2025, 8:50 PM UTC

josephg wrote: post #224

em-bee wrote: post #216

Earlier quoted context omitted.

there is a difference between the expiration of signing keys, and the expiration of the signature signed with those keys. the signature for a contract, or a bootloader, should remain valid indefinitely, even if the person/key is no longer allowed to sign contracts/bootloaders after some point of time.

That sounds impossible to enforce. Key signing is done offline. If I have an expired signing key, what’s stopping me setting my clock back a few years, creating a new signature and signing it? If the resulting key works indefinitely, the expiration date on my signing key is utterly meaningless.

Post by hdgvhicv » Sat, Jul 19, 2025, 9:29 PM UTC

A4ET8a8uTh0_v2 wrote: post #96

flexagoon wrote: post #66

Earlier quoted context omitted.

> Who controls the fucking certs? Cert authorities, just like in case of SSL. Is SSL also an evil technology designed to take away freedom from the internet? > vendor-selected boot certificates that can't be changed That's a lie. Certain drivers are signed with a specific key, and they can only be used when this key is installed, which makes sense. The same thing happens with SSL - if you remove pre-installed CA cert…

I might be misremembering it, but initial plans for Secure Boot were less open. It was only the stink raised that resulted in it being an option. Does it matter? Is it mine? If yes, then it should my concern. But that is the entire problem with trusted computing and recent trends in general. Corps become operators, users are downgraded to consumers.

Post by cafeinux » Sat, Jul 19, 2025, 11:45 PM UTC

stefan_ wrote: post #233

amluto wrote: post #180

Earlier quoted context omitted.

That seems to almost completely defeat the purpose of expiration. One could do a bit better by requiring the signed object to be timestamped by some sort of secure timestamping service. But then one should seriously consider the threat model that Secure Boot with default certificates is intended to defend against.

The day infosec nerds get rid of their unhealthy obsession with expiration and realize that systems irrecoverably breaking on an arbitrary random instant or requiring a true source of time to work are REALLY FUCKING INCOMPATIBLE with the real world, they might actually get something done. Until then, please don't bother the rest of us trying to get work done (and having to cleanup the mess you made - what do you mean…

Post by cesarb » Sun, Jul 20, 2025, 1:45 AM UTC

hdgvhicv wrote: post #243

A4ET8a8uTh0_v2 wrote: post #96

Earlier quoted context omitted.

I might be misremembering it, but initial plans for Secure Boot were less open. It was only the stink raised that resulted in it being an option. Does it matter? Is it mine? If yes, then it should my concern. But that is the entire problem with trusted computing and recent trends in general. Corps become operators, users are downgraded to consumers.

“ . But not only were they illegal, like debuggers—you could not install one if you had one, without knowing your computer's root password. And neither the FBI nor Microsoft Support would tell you that.” That’s what trusted boot is, as predicted in 1997. It will come eventually.

Post by flomo » Sun, Jul 20, 2025, 5:04 AM UTC

sugarpimpdorsey wrote: post #147

flomo wrote: post #18

Earlier quoted context omitted.

Maybe this isn't a great take, but RedHat/LKF/etc could obviously run a 'semi-competent' PKI, and probably should be. But doing so would allow PC vendors to cleanly segment machines between Windows and Linux (+$$), so perhaps it made the best sense to lay-low and use MS infrastructure for this.

This isn't really true. MS uses three separate CA's to sign Windows boot loaders, third party bootloaders (including Linux bootloaders) and UEFI Option ROMs. In theory, no manufacturer has to install all three as trusted. But it makes no business sense to do so - why have two separate hardware SKUs for the sole purpose of lock-in? Once word got out no one would buy from that manufacturer.