@01189998819991197253@infosec.pub
Post #4070889
2026-07-16 16:52 UTC
Functionally, though, wouldn’t it be the same as replacing the computer’s SecureBoot bootloader, since it’s Microsoft (in the case of SecureBoot) that doesn’t like the unofficial key that Linux installs? Shouldn’t the user be allowed to add or remove any key they desire from the allow list of official keys (maybe have some sort of decentralized verification system, if they user decides they want to verify it)?
I’m more thinking out loud here, trying to understand.
Replies (1)
-
@defaultusername@lemmy.dbzer0.com 2026-07-16 17:16
The difference is that with ARM TrustZone, there is an efuse burned with the key that the manufacturer set in the SoC itself that checks the signature of the primary bootloader, which cannot be modified. Standard computers do not have such a hardware-level key, so if you wanted to replace the bootloader with something like coreboot if it has been ported to your board, then you can. On smartphones, you do not have that option. Same thing goes for even more locked down systems like game consoles.