I am (still) trying to understand exactly how verified boot works and I am wondering what happens when a user-settable root of trust is used by the device. As said here:

If the device is LOCKED, the bootloader goes through the steps in Verifying Boot to verify the device's software. LOCKED devices boot only if the loaded OS is properly signed by the root of trust. For more details, see The boot flow.

  • Does the fact of setting a user-settable root of trust imply that the device has to be UNLOCKED?
  • Does it mean that a LOCKED device can boot on a custom OS if it is signed with the user-settable root of trust?
  • Is the warning still displayed if the user-settable root of trust is used to validate tue boot process?

1 Answer 1

  • Custom root of trust has to be set from fastboot according to docs. The OEM can implement it in different ways, the docs recommend that a custom certificate can only be installed from UNLOCKED state
  • Once your certificate is installed as root of trust, you can boot in LOCKED mode (only binaries signed by either you or the OEM will be allowed to boot)
  • Following the docs, a warning should be displayed if booting a custom signed firmware (booting the OEM signed one shouldn't ?)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .