>" Most implementations only allow 1 PK, and that PK is Microsoft's."
Isn't this a bit monopolistic and coercive though? "If you want the Microsoft Hologram on your product the PK has to be has to be Microsoft and there can only be one PK." I can't believe this doesn't violate some type of anti-trust laws.
There is no open standard that defines what a PC is. Linux and other operating systems are piggybacking on the Windows PC standard. If they want OEMs to manufacture hardware to their standards, they'll have to create their own "Linux-compatible" specification and persuade OEMs to follow it.
[0] https://msdn.microsoft.com/windows/hardware/commercialize/de...
[1] https://msdn.microsoft.com/en-us/library/windows/hardware/dn...
I disagree. I think the OEMs want to make hardware that consumer buy. I don't think they care one bit what OS consumers run on top of their hardware. In fact I would imagine OEMS would prefer to bring their products to market without consulting Microsoft at all.
It's coercive in the sense the the secure execution is predicated on there only being one PK and the OEMs have to knuckle under to MS just to be considered a "potential" machine that Microsoft allows to run Windows.
>"Linux and other operating systems are piggybacking on the Windows PC standard."
What exactly is the "Window PC Standard"? I have never heard this term before. Linux didn't piggy back on Windows anything. Maybe you mean X86? X86 predates Windows.
The signature database (db) and forbidden signature database (dbx) contain a whitelist and blacklist respectivly of keys, signatures, and hashes that are trusted to run.
Updates to either of the above lists must be signed by a Key Exchange Key (KEK). Most implementations allow multiple Key Exchanges Keys.
Updates to the list of Key Exchange Keys must be signed by the Platform Key (PK). Most implementations only allow 1 PK, and that PK is Microsoft's.
This means that any binary run on a secure boot machine with Microsoft's PK has a chain of trust rooted at Microsoft.
It may be possible to update the PK before transitioning the system to secure mode; but most consumer devices ship already in secure mode. This is different from simply disabling secure boot, which would still not allow you to update PK (for obvious reasons).
EDIT: It appears that it is called "user mode" and "setup mode" instead of secure mode.
Also it seems that some systems allow you to re-enter setup mode from the "bios" [0].
On an unrelated note, what do we call the firmware provided settings app now that it is no longer part of the BIOS.
[0] https://wiki.gentoo.org/wiki/Sakaki%27s_EFI_Install_Guide/Co...