microsoft/secureboot_objects v1.6.2

v1.6.2

Repository: microsoft/secureboot_objects

Tag: v1.6.2

Published: 2025-11-11T19:07:07Z

Prerelease: no

Release notes:

⚠️ IMPORTANT

No major security fixes.

1. Additional KEKs provided by ASUS have been submitted 2. A script to perform Multi Signature support for Secure Boot has been added 3. Updates to Make2023BootableMedia.ps1 and updating the signed version

What's Changed

[Secure Boot KEK Update] ASUS PK-Signed KEK Update @ChengAn0519 (#287)

Change Details

OEM Certificate Submission

OEM Name: ASUS Contact Email: ChengAn_Chiu@asus.com

Certificate Details

• Platform Key Thumbprint: 3BEF0726985C1C38CBA54C48A4B2B6EB281D9EE524CA7E1C8D6EE23942896F9A
• Expiration Date: 2040-01-01

Testing Completed

• [X] Windows validation
• [ ] Linux validation

Security Review

• [X] No known security issues

Additional Notes

Platform Key Thumbprint SHA1:EABCB3D43C0F3353F6396E297A8CBC4EF5F2AD39

Fix issue with ARM64 media, FAT32 USB handling and several other updates @ballsop (#285)

Change Details

Description

• Fixed issue with ARM64 media being handled as X64 media.
• FAT32 USB key generation improvements.
• No longer need to install ADK if not generating ISO images
• Added DebugOn parameter to easily turn on extra logging output
• A number of improvements to parameter handling
• Misc tweaks and optimizations

How This Was Tested

• Large number of iterations against current and old media images, including ARM64 media.

[Secure Boot KEK Update] ASUS PK-Signed KEK Update @ChengAn0519 (#284)

Change Details

OEM Certificate Submission

OEM Name: ASUS Contact Email: ChengAn_Chiu@asus.com

Certificate Details

• Platform Key Thumbprint: 3F7AD0C7F6D52E501D885A312B232A739EA44709844DA4002EAE5A005A3ABAEF
• Expiration Date: 2043-11-14

Testing Completed

• [X] Windows validation
• [ ] Linux validation

Security Review

• [X] No known security issues

Additional Notes

Platform Key Thumbprint SHA1:131A78741E5D4152489B838ED8F717FB167D6888

Script to perform UEFI multi signatures @Flickdm (#270)

Change Details

Description

As the ecosystem is marching towards certificate key expiry, we must standardize and document how multiple signatures are expected to work. This PR implements a python script that can take two signed binaries and output a third "multi" signed binary.

It does not appear that the windows authenticode specification dictates how multi-signatures are expected to be implemented. In that absence, EDK2 chose to implement multi-signatures using multiple WIN_CERTIFICATES according to the PE/COFF specification. The UEFI specification describes this as:

Multiple signatures are allowed to exist in the binary’s certificate table (as per PE/COFF Section “Attribute Certificate Table”).

This PR implements the code to perform the binary manipulation to get the multi signed binary in the correct format to be validated by EDK2.

Additionally, this scripts supports "--nested" which is similar to the "/as" command by SignTool. UEFI does not appear to support this today.

UEFI Style Multi-Signature

┌─────────────────────────────────────────────────────────────┐
│ DOS Header (64 bytes) │
│ Offset 0x3C: PE Header offset │
└─────────────────────────────────────────────────────────────┘
│ DOS Stub │
└─────────────────────────────────────────────────────────────┘
│ PE Signature "PE\0\0" │
└─────────────────────────────────────────────────────────────┘
│ COFF Header (20 bytes) │
└─────────────────────────────────────────────────────────────┘
│ Optional Header │
│ ┌─────────────────────────────────────────────────────┐ │
│ │ Magic: 0x010B (PE32) or 0x020B (PE32+) │ │
│ │ ... other fields ... │ │
│ │ │ │
│ │ Data Directories │ │
│ │ ┌──────────────────────────────────────────────┐ │ │
│ │ │ [4] Security Directory ◄─────────────────────┼───┼────┼──┐
│ │ │ VirtualAddress: 0xNNNN (file offset) │ │ │ │
│ │ │ Size: SSSS bytes (LARGER than source!) │ │ │ │
│ │ └──────────────────────────────────────────────┘ │ │ │
│ └─────────────────────────────────────────────────────┘ │ │
└─────────────────────────────────────────────────────────────┘ │
│ Section Headers │ │
└─────────────────────────────────────────────────────────────┘ │
│ .text Section (IDENTICAL to sources) │ │
└─────────────────────────────────────────────────────────────┘ │
│ .data Section (IDENTICAL to sources) │ │
└─────────────────────────────────────────────────────────────┘ │
│ .reloc Section (IDENTICAL to sources) │ │
└─────────────────────────────────────────────────────────────┘ │
│ ... other sections ... │ │
└─────────────────────────────────────────────────────────────┘ │
│ │ │
│ ┌────────────────────────────────────────────────────────┐ │◄─┘
│ │ WIN_CERTIFICATE Structure #1 │ │ ◄── First Authority
│ │ ┌──────────────────────────────────────────────────┐ │ │
│ │ │ dwLength (4 bytes) = Size of structure #1 │ │ │
│ │ │ wRevision (2 bytes) = 0x0200 │ │ │
│ │ │ wCertificateType (2 bytes) = 0x0002 (PKCS#7) │ │ │
│ │ └──────────────────────────────────────────────────┘ │ │
│ │ ┌──────────────────────────────────────────────────┐ │ │
│ │ │ PKCS#7 SignedData from source1.efi │ │ │
│ │ │ - Complete, independent PKCS#7 structure │ │ │
│ │ │ - Includes cert chain from first signer │ │ │
│ │ │ - Timestamp from first signing │ │ │
│ │ └──────────────────────────────────────────────────┘ │ │
│ │ ┌──────────────────────────────────────────────────┐ │ │
│ │ │ Padding (0-7 bytes for 8-byte alignment) │ │ │
│ │ └──────────────────────────────────────────────────┘ │ │
│ └────────────────────────────────────────────────────────┘ │
│ │
│ ┌────────────────────────────────────────────────────────┐ │ ◄── Second Authority
│ │ WIN_CERTIFICATE Structure #2 │ │
│ │ ┌──────────────────────────────────────────────────┐ │ │
│ │ │ dwLength (4 bytes) = Size of structure #2 │ │ │
│ │ │ wRevision (2 bytes) = 0x0200 │ │ │
│ │ │ wCertificateType (2 bytes) = 0x0002 (PKCS#7) │ │ │
│ │ └──────────────────────────────────────────────────┘ │ │
│ │ ┌──────────────────────────────────────────────────┐ │ │
│ │ │ PKCS#7 SignedData from source2.efi │ │ │
│ │ │ - Complete, independent PKCS#7 structure │ │ │
│ │ │ - Includes cert chain from second signer │ │ │
│ │ │ - Timestamp from second signing │ │ │
│ │ └──────────────────────────────────────────────────┘ │ │
│ │ ┌──────────────────────────────────────────────────┐ │ │
│ │ │ Padding (0-7 bytes for 8-byte alignment) │ │...