search

veracrypt / VeraCrypt-DCS

VeraCrypt EFI Bootloader for EFI Windows system encryption (LGPL)
GNU Lesser General Public License v3.0
134 stars 59 forks source link

sb_set_siglists.ps1 list of Lenovo certificate names different from dumpEfiVars.exe #6

Closed bluikko closed 6 years ago

bluikko commented 6 years ago

The dumpEfiVars.exe (obtained from https://www.veracrypt.fr/downloads/tools/dumpEfiVars.exe) dumps manufacturer certificates named:

And in \siglists there are:

References to these files are not listed in sb_set_siglists.ps1. Could I just add them as new lines/change the existing lines? Note the files at \siglists do not have any files with names referencing the manufacturer.

Edit: I just realized the idea is to cross-reference the output of dumpEfiVars.exe to the siglists on the VeraCrypt-DCS. So, in this case the correct lines to uncomment would be:

# Set-SecureBootUEFI -Time 2018-07-05T00:00:00Z -ContentFilePath $scriptPath\siglists\Lenovo_ThinkPad_Product_CA_2012-06-29_SigList.bin -SignedFilePath $scriptPath\siglists\Lenovo_ThinkPad_Product_CA_2012-06-29_SigList_Serialization.bin.p7 -Name db -AppendWrite:$true
# Set-SecureBootUEFI -Time 2018-07-05T00:00:00Z -ContentFilePath $scriptPath\siglists\Lenovo_UEFI_CA_2014-01-24_SigList.bin -SignedFilePath $scriptPath\siglists\Lenovo_UEFI_CA_2014-01-24_SigList_Serialization.bin.p7 -Name db -AppendWrite:$true

And as a last issue that is not totally clear, if I am using VeraCrypt 1.23-BETA2, do I still need to manually compile VeraCrypt-DCS or can I just use the boot loader included in the stock VeraCrypt 1.23-BETA2? The readme.txt at https://github.com/veracrypt/VeraCrypt/tree/master/src/Boot/EFI would indicate that compilation is needed.

If compilation is required, perhaps this should be listed in the readme.txt for VeraCrypt-DCS also somewhere?

idrassi commented 6 years ago

Yes, as you figured it out, these two certificates are already included in the script (lines 63 and 64 in the current version). So you just need to uncomment these two lines.

No need to do anything special on your side, just install 1.23-beta2, clear SecureBoot keys in the BIOS, launch the PowerShell script after uncommenting the adéquate lines, enable SecureBoot in the BIOS and then start the encryption process.

VeraCrypt-DCS bootloader that is included in VeraCrypt is signed with a custom key that is loaded using the PowerShell script and this same key is used to sign the certificates of various manufacturers that are referenced in the PowerShell script. If a user encounters a certificate that is not included in the script, he must submit it to us so that we sign it and then include it along side its signature in the PowerShell script.