Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #190295

Re: GRUB and boot partition

From Pascal Hambourg <pascal@plouf.fr.eu.org>
Newsgroups linux.debian.user
Subject Re: GRUB and boot partition
Date 2017-12-26 14:30 +0100
Message-ID <v0XsR-2Rb-5@gated-at.bofh.it> (permalink)
References (1 earlier) <v0U1X-nn-3@gated-at.bofh.it> <v0UOl-Wi-1@gated-at.bofh.it> <v0UY2-100-5@gated-at.bofh.it> <v0V7H-13J-9@gated-at.bofh.it> <v0WZQ-2n9-1@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

Le 26/12/2017 à 13:58, Reco a écrit :
> On Tue, Dec 26, 2017 at 11:59:18AM +0100, tomas@tuxteam.de wrote:
>>>>
>>>> Is there any inherent advantage to having /boot encrypted?
> 
>> The only things which might help against an evil maid attack [1] are:
>> secure boot (tying your bootable to secure firmware) [3],
> 
> Restricted Boot (let's call the thing the way it should be called from
> the start) could've solve this problem *if* it would be possible to
> force it to verify the bootloader (or the kernel) signed with *user*
> key.

I read that some UEFI implementations allow the user to manage secure 
boot keys. Carefully choose your hardware.

Oh, by the way I forgot twice to mention another situation when an 
encrypted /boot would provide an advantage : when the machine has a 
platform firwmare which supports LUKS encryption, such as CoreBoot, then 
the on-disk boot components could be entirely encrypted.

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

GRUB and boot partition microsoft gaofei <wangziheng@outlook.com> - 2017-12-26 03:40 +0100
  Re: GRUB and boot partition Pascal Hambourg <pascal@plouf.fr.eu.org> - 2017-12-26 10:50 +0100
    Re: GRUB and boot partition <tomas@tuxteam.de> - 2017-12-26 11:40 +0100
      Re: GRUB and boot partition Reco <recoverym4n@gmail.com> - 2017-12-26 11:50 +0100
        Re: GRUB and boot partition <tomas@tuxteam.de> - 2017-12-26 12:00 +0100
          Re: GRUB and boot partition Pascal Hambourg <pascal@plouf.fr.eu.org> - 2017-12-26 12:30 +0100
            Re: GRUB and boot partition <tomas@tuxteam.de> - 2017-12-26 12:40 +0100
          Re: GRUB and boot partition Reco <recoverym4n@gmail.com> - 2017-12-26 14:00 +0100
            Re: GRUB and boot partition Pascal Hambourg <pascal@plouf.fr.eu.org> - 2017-12-26 14:30 +0100
              Re: GRUB and boot partition Reco <recoverym4n@gmail.com> - 2017-12-26 14:50 +0100
              Re: GRUB and boot partition <tomas@tuxteam.de> - 2017-12-26 15:00 +0100
      Re: GRUB and boot partition Pascal Hambourg <pascal@plouf.fr.eu.org> - 2017-12-26 12:20 +0100
        Re: GRUB and boot partition <tomas@tuxteam.de> - 2017-12-26 12:30 +0100
          Re: GRUB and boot partition Pascal Hambourg <pascal@plouf.fr.eu.org> - 2017-12-26 12:40 +0100
            Re: GRUB and boot partition <tomas@tuxteam.de> - 2017-12-26 12:50 +0100

csiph-web