Secure Boot

In short: Secure Boot is a UEFI feature that at startup allows only software that is digitally signed and known as trustworthy. This prevents malicious code (bootkits) from nesting before the operating system.

In more detail: Before each startup step the firmware checks the signature of the next program: bootloader, operating system kernel, firmware drivers. If the signature is missing or the file was changed, startup is refused.

In Depth

Chain of trust:

UEFI firmware ──checks──► bootloader ──checks──► OS kernel ──checks──► drivers
 (keys in the firmware: PK, KEK, db, dbx)

• Key databases: PK (platform key, owner), KEK (key exchange keys), db (allowed signatures), dbx (revoked signatures/hashes).
• Who signs: Microsoft signs Windows and a shim loader with which many Linux distributions (Ubuntu, Fedora) start. You can enroll your own keys (MOK).
• Windows 11: Requires Secure Boot (together with UEFI and TPM 2.0).
• Benefit: Protects against bootkits and manipulated bootloaders that try to defeat a password or disk encryption.
• Limits: Does not protect against malware that starts only in the running system, nor against bugs in signed drivers. Revoked signatures must be added to dbx via updates (for example after the BlackLotus vulnerability).
• Turning off: Possible in the UEFI menu, needed for example for unsigned drivers or some Linux variants. You lose the protection.
• Checking status (Windows): msinfo32 → “Secure Boot State”.
• Secure Boot ≠ encryption: It protects the integrity of startup, not the data. For that there is BitLocker.

See also: UEFI, Bootloader, BitLocker, TPM and TPM 2.0