SUSE Linux outlines plans for Windows 8 secure boot

IDG News Service - Well, the Secure Boot saga keeps going on and on as Linux distributions far and wide decide how they're going to work around Windows 8's planned restrictions, and this week we heard from yet another project.

It was SUSE Linux to speak out this time, and what it has proposed amounts in many ways to a hybrid approach between what we've already seen from Ubuntu and Fedora.

"UEFI Secure Boot is a useful technology, making it harder for attackers to hide a rootkit in the boot chain," began Olaf Kirch, director of the SUSE Linux Enterprise department in SUSE Engineering, in a blog post on Wednesday. "At the same time, already the basics of its operation -- establishing a single root of trust -- conflict with the principles of Open Source development, which must be independent and distributed to work."

'It's a Smart Solution'

For those who missed it, Windows 8's Unified Extensible Firmware Interface (UEFI) will stipulate that only operating systems with an appropriate digital signature can boot. Both the Free Software Foundation and the Linux Foundation have weighed in with their own views on the matter.

Yet there are two ways of working around those restrictions, Kirch explained.

"One is to work with hardware vendors to have them endorse a SUSE key which we then sign the boot loader with," he explained. "The other way is to go through Microsoft's Windows Logo Certification program to have the boot loader certified and have Microsoft recognize our signing key."

SUSE plans to use the shim loader originally developed by Fedora, Kirch said: "It's a smart solution which avoids several nasty legal issues, and simplifies the certification/signing step considerably," he explained.

That shim loader will load the GRUB 2 boot loader, verify it, and then load kernels signed by a SUSE key.

Two Keys Possible

On Thursday, however, Vojet