# What is Secure Boot?

> Secure boot is a startup control that allows only software components authorized by platform policy to execute at covered stages of a device’s boot process.

- Canonical URL: https://yellowcube.eu/glossary/secure-boot/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

Starting from an initial trust anchor, each stage verifies a cryptographic signature or other approved integrity evidence for the next component before transferring control, forming a chain of verification toward the operating environment.

Implementations differ across device classes. Unified Extensible Firmware Interface (UEFI) Secure Boot, for example, uses enrolled keys and signature databases to authorize or forbid UEFI drivers and boot applications. Key enrollment, update, revocation, recovery, and physical or administrative controls are therefore part of the security design.

### Key points

- **Authorization policy:** Define who may authorize boot components, protect trust anchors and signing keys, manage authorization and revocation data, and record controlled changes to policy.
- **Verification and failure:** Authenticate each covered component before execution and enter a defined refusal, recovery, or restricted path when verification fails rather than silently bypassing enforcement.
- **Lifecycle operation:** Support secure updates, compromised-key or vulnerable-component revocation, ownership transfer, recovery media, and tested procedures that preserve availability.
- **Important limitation:** Secure boot establishes that covered components are authorized under the current policy; it does not prove they are vulnerability-free, correctly configured, or trustworthy at runtime. Weak keys, permissive policy, rollback, uncovered components, or later compromise can defeat the intended outcome.

### Related terms

[Firmware security](<https://yellowcube.eu/glossary/firmware-security/>) · [Rootkit](<https://yellowcube.eu/glossary/rootkit/>) · [Endpoint security](<https://yellowcube.eu/glossary/endpoint-security/>) · [Supply-chain security](<https://yellowcube.eu/glossary/supply-chain-security/>)

### Sources

[UEFI Forum: UEFI Specification 2.11](https://uefi.org/specifications) · [NIST SP 800-193: Platform Firmware Resiliency Guidelines](https://csrc.nist.gov/pubs/sp/800/193/final) · [NIST SP 800-147: BIOS Protection Guidelines](https://csrc.nist.gov/pubs/sp/800/147/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.