On Mo, 06.07.20 16:34, Neal Gompa (ngompa13(a)gmail.com) wrote:
Encryption != integrity/authentication. The only thing encryption
guarantees is that the data is not visible, not that it hasn't been
tampered with. Usually, dm-verity or dm-integrity is used for what
you're asking for. Android uses dm-verity, if I remember correctly.
EFI SecureBoot uses PE signed executables.
Less complexity in the boot chain, mainly. But the EFI drivers would
need to be signed by MS, I think? That would massively complicate
things.
Could use SHIM like everything else.
Lennart
--
Lennart Poettering, Berlin