MOK (Machine Owner Key) for Secure Boot

Almighty1 · Oct 7, 2024

On Dell machines, there does not appear to be a MOK (Machine Owner Key) management and I was reading this which mentions the different UEFI keys:

The Meaning of all the UEFI Keys | James Bottomley's random Pages

blog.hansenpartnership.com

Would MOK actually be one of those?

Jacee · Oct 7, 2024

This is from Dell: MOK Message When Booting Linux with Secure Boot Enabled | Dell US

antspants · Oct 7, 2024

What is it you’re wanting to do, mate?

Is this for a Linux project?

antspants · Oct 7, 2024

To force activate the Machine Owner Key (MOK) on Dell laptops, especially when dealing with Secure Boot and custom kernels or drivers, follow these steps:

Boot into your operating system and open a terminal.
Generate a MOK key if you haven’t already:
sudo mokutil --import /path/to/your_public_key.der
Replace /path/to/your_public_key.der with the actual path to your MOK key file.
Reboot your system. During the boot process, you will be prompted to enroll the MOK.
Enroll the MOK:
- When the MOK management screen appears, press any key to continue.
- Select “Enroll MOK” and press Enter.
- Select “Continue” and press Enter.
- When prompted, select “Yes” to enroll the key.
- Finally, select “Reboot” to restart your system.

This process will enroll your custom key, allowing the system to trust and load the unsigned or custom-signed software - As per Jacee’s link

Bree · Oct 7, 2024

The MOK is used when booting Linux. More here from Ubuntu...

UEFI/SecureBoot - Ubuntu Wiki

antspants · Oct 7, 2024

Almighty1 said:
On Dell machines, there does not appear to be a MOK (Machine Owner Key) management and I was reading this which mentions the different UEFI keys:

The Meaning of all the UEFI Keys | James Bottomley's random Pages

blog.hansenpartnership.com

Would MOK actually be one of those?

In somewhat of an answer to your question:

I ran that guys descriptions through CoPilot:

Yes, the descriptions you provided are related to the UEFI Secure Boot process, which includes the Machine Owner Key (MOK) system. Here’s a brief summary of how they relate:

UEFI Secure Variables: These are used to store keys and other security-related data. MOK keys are stored in these secure variables to ensure that only trusted software is loaded during the boot process.
Authentication Descriptor: This ensures that updates to secure variables are authenticated, preventing unauthorized changes. When you enroll a MOK, it involves creating an authentication descriptor to validate the key.
Setup and User Modes: These modes determine how secure variables can be modified. In Setup Mode, you can enroll MOKs without the usual authentication checks, which is useful when setting up a new system or making significant changes.
Platform Key (PK) and Key Exchange Key (KEK): These keys are part of the Secure Boot infrastructure. The PK controls access to the KEK, and the KEK is used to update the signature database, which includes MOKs.
Forbidden Signatures Database (dbx) and Signature Database (db): These databases store hashes and signatures of trusted and forbidden binaries. MOKs are used to add custom keys to the db, allowing the system to trust additional software.

Almighty1 · Oct 7, 2024

Jacee said:
This is from Dell: MOK Message When Booting Linux with Secure Boot Enabled | Dell US

Yes but that's to boot linux. I'm trying to enroll the VenToy USB so it will boot in secure mode as the method here doesn't work:

Ventoy

Ventoy is an open source tool to create bootable USB drive for ISO files. With ventoy, you don't need to format the disk again and again, you just need to copy the iso file to the USB drive and boot it.

www.ventoy.net

So @antspants, couldn't do the linux part yet until I get the USB enrolled so it boots in secure mode.
This is what it looks like inside the actual BIOS.

This thread claims that there is no way to even enroll VenToy anymore:

Ventoy enroll key manager not working in new Dell laptops that use SecureBoot

So if I am understanding it correctly, I basically add the key using db?

antspants · Oct 7, 2024

Well, reading the text at the bottom basically states (to my understanding) that if you screw up, it reverts back to the original key. OR there is a Reset Option.

I’d say play with the different options?

I’d also say wait to see if you can get a definitive answer from someone.

Bree · Oct 7, 2024

Almighty1 said:
...the VenToy USB so it will boot in secure mode....

I don't bother on my Dell. You're going to use the F12 menu to boot from it anyway. Under Other Options you can turn off Secure Boot.

Almighty1 · Oct 13, 2024

antspants said:
Well, reading the text at the bottom basically states (to my understanding) that if you screw up, it reverts back to the original key. OR there is a Reset Option.

I’d say play with the different options?

I’d also say wait to see if you can get a definitive answer from someone.

I actually tried doing a custom, clear and then reset and then Windows 11 will no longer boot up with Secure Boot Mode enabled...

How to fix this - Operating System Loader failed signature verification

Yesterday, I rebooted my system as soon as it got to the lock screen on my Dell XPS 15 9570 notebook and the system kept booting Dell SupportAssist instead of Windows 11 which was showing "Operating System Loader failed signature verification" as seen below: The only way I can boot into...

www.elevenforum.com

Almighty1 · Oct 13, 2024

Bree said:
I don't bother on my Dell. You're going to use the F12 menu to boot from it anyway. Under Other Options you can turn off Secure Boot.

View attachment 111500

All that does is basically go back into the BIOS itself, no different than hitting the F2, turn off Secure Mode and then Save Settings which would not be a problem if it was only to change it for that one time but after using the USB Flash Drive, I would have to go back into the BIOS to enable it again before booting Windows or else things like Hyper-V won't work which is basically 10-20 minutes by the time I realize it. I am sure the answer will also benefit others in the future too.

Almighty1 · Oct 13, 2024

Earlier this AM, I had some time to test the Change Boot Mode Settings in the F11 menu as @Bree mentioned and it only does something if one had Secure Boot Enabled and the Secure Boot Mode was on Deployed as all it does is toggle the Secure Boot Enabled between on and off.

It does not work if one had Secured Boot Enabled and Secure Boot Mode set to Audit which already allows everything to boot and Windows will see that Secure Boot is disabled when it's in Audit mode. The Expert Key Management function is there so only devices that are in the database will boot in Secure Boot in Deployed Mode when needed, what's strange is no one has figured out how to use it even from Googling.

MOK (Machine Owner Key) for Secure Boot

Well-known member

My Computer

Accroche-toi à ton rêve

My Computer

Like a rolling drone.

My Computers

Like a rolling drone.

My Computers

Well-known member

My Computers

Like a rolling drone.

My Computers

Well-known member

My Computer

Like a rolling drone.

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Similar threads