Hallo, hier TS, Ik ben de fucking manual gaan lezen. In mijn herinnering zat die achter een paywall maar dat zal iets anders geweest zijn (TPM of WiFi of zo, wat ook met crypto werkt). https://uefi.org/specs/UEFI/2.10/32_Secure_Boot_and_Driver_Signing.html. Hiermee kan ik mijn eigen vragen beantwoorden. 32.3.6. Platform Firmware Key Storage Requirements This section describes the platform firmware storage requirements of the different types of keys. Platform Keys: The public key must be stored in non-volatile storage which is tamper and delete resistant. Key Exchange Keys: The public key must be stored in non-volatile storage which is tamper resistant. Careful consideration should be given to the security and configuration of any out-of-band management agent (e.g. hypervisor or service processor) such that the platform cannot exploit the management agent in order to circumvent Secure Boot. Dus PK en KEK zitten in non-volatile memory. Die overleven dus een CMOS reset. Verderop staat: The ...