Well, something has to be. You can have your EFI partition on a separate drive and then the actual drive will be fully encrypted. It’s just as good as we can get, the algorithm for decrypting the data obviously can’t be encrypted.
I think there are implementations with encryption logic stored in the BIOS or on a separate chip, but don’t quote me on that. And even then, the decryption logic itself will be unencrypted, because, as it happens, computers can’t run encrypted code.
efi partition on a separate disk makes a lot of sense actually, imo the biggest point of fde is that your boot environment doesn’t get fucked with from outside your trusted os, so if you put your efi on a read only CD or something and lock your bios to boot into that, that can’t really be tampered with easily in software
As bad as secure boot is, that’s exactly the use case for it. Frankly, you can both swap the CD and solder a new BIOS flash if you are really interested in boot poisoning, the latter is just a tiny bit harder to do without some sort of trace.
What do you mean?? Our Motherboards come equipped with the latest and greatest Military Grade™ MD5 RealGood™ Encryption Technology.
What do you mean it’s not longer considered secure??? Fake news, we’d never lie to you.
Well, something has to be. You can have your EFI partition on a separate drive and then the actual drive will be fully encrypted. It’s just as good as we can get, the algorithm for decrypting the data obviously can’t be encrypted.
I think there are implementations with encryption logic stored in the BIOS or on a separate chip, but don’t quote me on that. And even then, the decryption logic itself will be unencrypted, because, as it happens, computers can’t run encrypted code.
efi partition on a separate disk makes a lot of sense actually, imo the biggest point of fde is that your boot environment doesn’t get fucked with from outside your trusted os, so if you put your efi on a read only CD or something and lock your bios to boot into that, that can’t really be tampered with easily in software
As bad as secure boot is, that’s exactly the use case for it. Frankly, you can both swap the CD and solder a new BIOS flash if you are really interested in boot poisoning, the latter is just a tiny bit harder to do without some sort of trace.
I meant software attacks, if your hardware is compromised it’s pretty much already game over unless you use something esoteric like heads maybe
Why not have the BIOS decrypt the disk then continue the boot process as normal?
Mainly because then the manufacturer decides on how your stuff is encrypted, no likie.
What do you mean?? Our Motherboards come equipped with the latest and greatest Military Grade™ MD5 RealGood™ Encryption Technology.
What do you mean it’s not longer considered secure??? Fake news, we’d never lie to you.