ClayDaniels

BIOS Secure Boot Keys Project

Software Tools:

efivar

openssl

gpg (gnupg)

Sites of interest:

https://www.rodsbooks.com/efi-bootloaders/controlling-sb.html

http://h10032.www1.hp.com/ctg/Manual/c05649759

There are four, maybe five, secure boot keys in the nvram of the bios on the motherboard. They have been placed there by the manufacturer and other parties, like Microsoft. They are:

Platform Key (PK)

Key Exchange Key (KEK)

Database Key (db)

Database Blacklist Key (dbx)

Machine Owner Key (MOK)

If you wish to take control of your computer, you may want to do more than just disabling secure boot, and provide your own secure boot keys. The very first step should be to find and make a backup copy. To that end in FreeBSD you can use efivar.

Example:

root@r355889:/efivar # efivar -l | less
~
8be4df61-93ca-11d2-aa0d-00e098032b8c-KEKDefault
~
root@r355889:/efivar # efivar -n 8be4df61-93ca-11d2-aa0d-00e098032b8c-KEKDefault -b > /efivar/KEK
root@r355889:/efivar # ls -al
total 32
drwxr-xr-x   2 root  wheel    512 Dec 22 00:07 .
drwxr-xr-x  20 root  wheel   1024 Dec 21 22:58 ..
-rw-r--r--   1 root  wheel   1609 Dec 22 00:07 KEK

Repeat for PK, db, & dbx. It's unlikey you will have a MOK already installed as that is something sometimes installed by you the owner.

Save these keys in case they need to be re-installed and also to use in the creation of new keys.

Interests

The Python Tutorial https://docs.python.org/3/tutorial/

A Little C Primer https://en.wikibooks.org/wiki/A_Little_C_Primer

Netwide Assembler (NASM) Tutorial https://cs.lmu.edu/~ray/notes/nasmtutorial/

Tools

Rod Smith's Refind Boot Manager http://www.rodsbooks.com/refind/

Contributions

LXDE - FreeBSD Wiki https://wiki.freebsd.org/LXDE

Email: clay.daniels.jr@gmail.com

Email: clays.shell@sdf.org