EDK2_00_02_06 UEFI SecureBoot (draft)

Owned by Yong Li (Deactivated)
Last updated: Oct 09, 2023
2 min read

Enabled UEFI Secure Boot on UEFI and StandaloneMm firmware

Step 1: Build EDK2 and StandaloneMm with SecureBoot enabled

Follow the steps in EDK2_00_02_04 Evaluate with OpenSBI to build the EDK2 and StandaloneMm with SecureBoot enabled

Step 2: Create Custom Keys for Secure Boot

$ openssl req -new -x509 -newkey rsa:2048 -subj "/CN=Platform Key/" -keyout PK.key -out PK.crt -days 3650 -nodes -sha256
$ openssl x509 -in PK.crt -out PK.cer -outform DER
$ openssl req -new -x509 -newkey rsa:2048 -subj "/CN=Key Exchange Key/" -keyout KEK.key -out KEK.crt -days 3650 -nodes -sha256
$ openssl x509 -in KEK.crt -out KEK.cer -outform DER
$ openssl req -new -x509 -newkey rsa:2048 -subj "/CN=Database/" -keyout DB.key -out DB.crt -days 3650 -nodes -sha256
$ openssl x509 -in DB.crt -out DB.cer -outform DER

Choose an EFI application in your edk2 build aritfacts to do the test, or use this EmptyApplication-Riscv.efi

$ sbsign --key DB.key --cert DB.crt --output EmptyApplication-Riscv.efi.signed EmptyApplication-Riscv.efi

Update the sbsigntool to the latest one if you encounter "invalid PE header magic" issue in signing riscv64 binary

Step 3: Copy the public key to the fat disk

$ cp EmptyApplication.efi.signed ~/src/fat/

$ cp EmptyApplication.efi~/src/fat/

$ cp *.cer ~/src/fat/


Step 4:  Enroll the PK, KEK, DB keys to the EDK2 as the Custom Secure Keys

Execute the run.sh script in EDK2_00_02_04 Evaluate with OpenSBI

Playing with Secure Boot in Tianocore

By default, TianoCore boots up into Setup Mode, meaning the platform is not provisioned with any keys and the user can take control.  To take control, go to the EFI menu screens (type 'exit' command if you’re at the efi boot prompt) select the “Device Manager” entry, then “Secure Boot Configuration”.  Here you will see the status of the Secure Boot flag (“Attempt Secure Boot”) and the platform mode.  Setting the platform from “Standard Mode” to “Custom Mode” will allow you to edit the keys. Once the platform is in “Custom Mode”, a “Custom Secure Boot Options” menu will appear and you will be able to manipulate the four sets of key databases from here.  The format of all key files for openssl generated keys is DER format (by default openssl generates PEM format).  Note that the KEK, db and dbx options will ask you for a GUID as well as a key file.  The GUID is the platform’s way of identifying the key.  It serves no purpose other than for you to tell which key is which when you delete them (it’s not used at all in signature verification).  By default, since GUIDs aren’t really human readable, I just ignore this and the GUID is set to all zeros.



After Enrolling the PK, KEK, and DB to the Secure Boot Keys, the Secure Boot should be enabled



Step 6:  Test the signed EFI application
Reboot and Execute the EmptyApplication-Riscv.efi - get Access Denied


Execute the EmptyApplication-Riscv.efi.signed - get SUCCESS