You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
We had perfectly running MS signed shim boot loader and Secure Boot worked fine.
But then our Certificate Expired. We need to create new shim boot loader and pass shim-review and MS signing process.
In our Dockerfile I replaced reference to old expired certificate to reference to new Certificate.
Shim 15.7 is built properly from Docker. It is a simple build with command like this:
make VENDOR_CERT_FILE=my-corp.cer
Then I emulate MS signing for this shimx64.efi and sign new grub and kernel using new certificate.
I had written into PC EFI BIOS corresponding emulation databases for PSK, KEK, PK.
I did that many times in the past with our older Certificate embedded into shim.
But now Secure Boot fails with Error "Veriication failed (0x1A) Security Violation"
Question: what are requirements for Certificate? Are any limitations on used crypt algorithms exist?
I am trying to check what is grub signed difference.
I see that with new Certificate signed grub has record "Digest Encryption Algorithm ECC" (left image)
But grub signed with older Certificate has record "Digest Encryption Algorithm RSA" (right image):
Can it be issue or not?
Second question is how to debug shim? Can I receive debug messages via serial port or somehow else? Please advise how to configure any debug process!
The text was updated successfully, but these errors were encountered:
Yeah, I wouldn't expect ECC to be well tested since MS still ships RSA keys in system firmwares and there aren't any government requirements (that I know of...) for anything but RSA yet.
We had perfectly running MS signed shim boot loader and Secure Boot worked fine.
But then our Certificate Expired. We need to create new shim boot loader and pass shim-review and MS signing process.
In our Dockerfile I replaced reference to old expired certificate to reference to new Certificate.
Shim 15.7 is built properly from Docker. It is a simple build with command like this:
make VENDOR_CERT_FILE=my-corp.cer
Then I emulate MS signing for this shimx64.efi and sign new grub and kernel using new certificate.
I had written into PC EFI BIOS corresponding emulation databases for PSK, KEK, PK.
I did that many times in the past with our older Certificate embedded into shim.
But now Secure Boot fails with Error "Veriication failed (0x1A) Security Violation"
Question: what are requirements for Certificate? Are any limitations on used crypt algorithms exist?
![image](https://private-user-images.githubusercontent.com/89782963/301078576-450b5f66-8b8f-4c9f-82a6-112c1e8aad8f.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjQ1MzQxNzUsIm5iZiI6MTcyNDUzMzg3NSwicGF0aCI6Ii84OTc4Mjk2My8zMDEwNzg1NzYtNDUwYjVmNjYtOGI4Zi00YzlmLTgyYTYtMTEyYzFlOGFhZDhmLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MjQlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODI0VDIxMTExNVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTM2ZDY2ODQyN2YwNmZjMjU1YzQwYTE4YzQ1N2U4MDRmMmQ1NGMyMTQ2ZTM5OTcwYjk0NGQxNmZmOWI0YzE5NjkmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.ZssNDu6qcdlNLzHNVSHFBKw0nT3H0Lgv55Lal8g1Qsc)
I am trying to check what is grub signed difference.
I see that with new Certificate signed grub has record "Digest Encryption Algorithm ECC" (left image)
But grub signed with older Certificate has record "Digest Encryption Algorithm RSA" (right image):
Can it be issue or not?
Second question is how to debug shim? Can I receive debug messages via serial port or somehow else? Please advise how to configure any debug process!
The text was updated successfully, but these errors were encountered: