4

As I understand it, both "Secure Boot" and "Verified Boot" work in the same way. In particular:

  • on boot, the first thing that runs is code found in ROM. This ensures that it can be "trusted"
  • the ROM code verifies the signature of the next piece of boot software, only running it if the signature is valid
  • this process of verifying code continues all the way up into user space

Does that high level overview miss out on some key difference? Or are they the same, and we just call it "Secure Boot" if the rest of the boot process meets the UEFI spec?

Improve this question
2
  • 2
    They are not the same. Secure Boot is a feature of UEFI and limited to the x86 platform. Verified Boot (appears to be) a feature of Android, and limited to the ARM platform
    – Ramhound
    Sep 22, 2018 at 16:58
  • Secure Boot is absolutely not a feature limited to X86. You can find this term used in documents from NXP or Qualcomm to describe their security architectures which are based on ARM. The term Secure Boot is much more generally used whereas Verified Boot is a term specific to android but describing mostly the same thing
    – cyphunk
    Jan 21, 2021 at 14:28

2 Answers 2

Reset to default
4

Verified Boot

Verified Boot strives to ensure all executed code comes from a trusted source (usually device OEMs), rather than from an attacker or corruption. It establishes a full chain of trust, starting from a hardware-protected root of trust to the bootloader, to the boot partition and other verified partitions including system, vendor, and optionally oem partitions. During device boot up, each stage verifies the integrity and authenticity of the next stage before handing over execution. In addition to ensuring that devices are running a safe version of Android, Verified Boot check for the correct version of Android with rollback protection. Rollback protection helps to prevent a possible exploit from becoming persistent by ensuring devices only update to newer versions of Android. In addition to verifying the OS, Verified Boot also allows Android devices to communicate their state of integrity to the user.

Secure boot

Secure boot is a security standard developed by members of the PC industry to help make sure that a device boots using only software that is trusted by the Original Equipment Manufacturer (OEM). When the PC starts, the firmware checks the signature of each piece of boot software, including UEFI firmware drivers (also known as Option ROMs), EFI applications, and the operating system. If the signatures are valid, the PC boots, and the firmware gives control to the operating system. The OEM can use instructions from the firmware manufacturer to create Secure boot keys and to store them in the PC firmware. When you add UEFI drivers, you'll also need to make sure these are signed and included in the Secure Boot database.

For details we can refer to the articles Secure boot and Verified Boot.

Improve this answer
3
  • 2
    Just to further clarify: Verified Boot and Secure Boot are both ways to address a similar concern: boot security. But they 1) apply to entirely different computers and computer architectures, 2) take different methods to accomplish their end goals. You will never see an option to run both or either on the same computer.
    – music2myear
    Sep 25, 2018 at 15:40
  • Secure Boot and Verified Boot describe mostly the same thing but Secure Boot is a term applied more generally throughout the field and on many architectures, whereas Verified Boot appears to be specific to Android platforms only.
    – cyphunk
    Jan 21, 2021 at 14:29
  • 1
    I love people just copy-pasting articles without even adressing the question of the OP and actually noting the differences or similarities..
    – Ophidian
    Jun 15, 2021 at 5:39
2

Secure Boot and Verified Boot are largely the same thing and describe software authentication frameworks that often require some hardware support to implement properly. "Verified Boot" is more specific to Android platforms whereas "Secure Boot" is a more general term used for many platforms. Despite Microsoft documentation claiming "Secure Boot" is a PC specific standard, one finds this term used by many other platform vendors (NXP, Qualcomm, others) to describe their security frameworks for firmware authentication.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .