Currently there is a great and controversial discussion over a new BIOS implementation. Known as UEFI Secure Boot, it provides for the deployment of a ‘Signed Boot’, i.e., an operating system that can be installed on your machine if previously signed.

 To comment a bit about this, one of the international attractions of Latinoware 2012 will be Google software engineer, Ron Minnich. Besides presenting Coreboot – a technology for implementing free BIOS created by him – he will discuss other topics in his lecture. Check out the full interview:

 What is the situation now? We heard that Microsoft will be releasing security keys for signing and market them with other operating systems vendors. Red Hat and Canonical have already bought. How this will impact a regular user or company or a government?

 The situation today is that PCs offer users the freedom to do anything they want. PCs have been this way since their inception in the ’70s – the original creators made every effort to keep them open as long as possible. Even IBM, when they standardized what we now call the PC, opened the project, including providing a list of BIOS that came with the machine – albeit under copyright, which made it necessary to reverse engineer the BIOS.

The “secure boot” UEFI is designed to restrict this freedom in the name of security. Since the beginning of the personal computer era until now, a PC owner could start any operating system he wanted. Even today, a user who wants to convert a PC from Windows to Linux need only insert a CD and push the button to do so. The newer PCs will not be as open. For x86 systems to “secure boot”, commercial PCs will almost certainly start the software only – bootloader or operating system – signed with the key property of Microsoft, unless the creator of the PC provides a way to disable “Safe Boot “- and the user knows how to disable it.

While it is possible to install certificates on PCs other than those created by Microsoft, I believe it is unlikely that vendors will go to all this trouble. While large distributions can get their accesses or bootloaders signed by Microsoft, the small ‘guys’  will have to find the $ 99 for subscribed services or try to convince users to disable the “Safe Boot” – which many users may be unwilling to do. We can expect campaigns trying to convince users not to “make their PCs less safe” by disabling the secure boot. In any case, this seems to be a barrier to entry. Returning to 1991, with these limitations, it would be difficult to see Linux happen in the same way.

 With ARM, it is much worse, because disable “Safe Boot” is not an option. ARM has traditionally been very open, but this opening can begin to change. You can find a summary here. http://mjg59.dreamwidth.org/13713.html

And, as was pointed out, the requirements of UEFI secure boot have implications on which modules can be loaded on Linux. This goes further than just starting. Simply put, with the UEFI secure boot, open PCs as we have known them for just over 30 year are overs.

 The actual implementation of the signed boot technology will allow governments to sign software on their own?

 I believe so. But is a complex process that many governments may not be willing to establish. Matthew explains much better than I could: http://mjg59.dreamwidth.org/9844.html. I doubt that governments do anything to make the closed system more open. It is not in their nature.

We have seen many attempts to protect devices such as tablets, smartphones, video game consoles, etc.. against the execution of arbitrary code with similar technology and they failed at some point. Do you believe that signed boot technology for the common PC will be able to avoid joining this list?

 I’m not sure. It certainly seems that many companies are trying to shut down the PC in the same way that these other products are closed. At the same time, I never thought that the Xbox 360 would work with unsigned code, however this: http://www.howtogeek.com/95339/new-xbox360-hack-works-on-all-360-models- 2 / works. I learned not to underestimate the ingenuity of a group of motivated hackers.

As far as we know, however, lack of community participation means that the UEFI secure boot has a fault and is the next WEP (http://en.wikipedia.org/wiki/Wired_Equivalent_Privacy), or can be broken as easily as the Clipper chip: http://en.wikipedia.org/wiki/Clipper_chip)

Will this technology really make a difference in relation to security, and who should have control of the secret key to sign other Operating Systems?

 This will ensure that you somehow cannot start an unauthorized operating system – assuming the EFI has not been hacked, which it has, several times. My concern is that UEFI secure boot seems to have more than one goal. Yes, it is limiting what can be started as the only “trustworthy” code. It is also making quite inconvenient to start anything other than Windows. The confusion of “starting a secure operating system” with “just starting Windows” is not desirable from my point of view.

Security experts (I’m not one of them) say that the real area of opportunity for the “bad guys” is the browser. UEFI secure boot naturally has no value for this problem. Restrict PCs to starting ” signed operating systems” seems to me to be the solution of a control problem for certain vendors, restricting the freedom to start any operating system, rather than solving a security problem. Anyhow, it must be possible to solve the signed operating system problem in a manner that is less inconvenient for users – who, after all, pay for hardware that will be restricted to use in certain ways. I believe that is not a good tradeoff. It could undoubtedly have been resolved in a better way if there was a more community involvement.

But community participation in their design and implementation has never been a priority of EFI as far as I know.

 * Ron Minnich is a software engineer at Google, inventor of LinuxBIOS in 1999, led the project in its first 10 years and recently returned to work in Coreboot.