Secure Boot
also: UEFI Secure Boot
A UEFI firmware security feature that verifies the digital signature of the bootloader before execution, preventing unauthorized or malicious code from loading during system startup.
Secure Boot is a security standard built into UEFI (Unified Extensible Firmware Interface) that cryptographically verifies the integrity of boot components before the operating system launches. When enabled, the firmware checks that the bootloader, kernel, and other critical startup files are signed by trusted authorities.
The system maintains a database of trusted public keys (the Key Exchange Key or KEK) and revoked certificates, allowing it to reject any unsigned or maliciously modified boot code. If verification fails, the system will refuse to boot, protecting against rootkits and bootkit attacks that would otherwise run before the OS kernel can enforce security policies.
Example: A Linux system with Secure Boot enabled uses signed kernel images and bootloaders (like GRUB or systemd-boot). If someone attempts to replace the kernel with a compromised version, the firmware detects the invalid signature and halts the boot process.
Note: Secure Boot can complicate Linux installations and custom kernel usage, as unsigned or self-signed binaries will be rejected. Many distributions provide signed bootloaders and kernels for seamless compatibility.