Back to DashboardHardware InfrastructurePhase 6 · Infrastructure & Performanceadvanced60 min

Secure Boot & Firmware PQC

Migrate UEFI Secure Boot, firmware signing, and hardware root of trust to post-quantum cryptography. Covers ML-DSA-65 firmware signatures, TPM 2.0 key hierarchies, UEFI db/KEK/PK migration, and BIOS vendor roadmaps.

Why this matters: Secure Boot is the root of the whole chain of trust — a quantum-broken PK/KEK/db hierarchy doesn't just compromise one signature, it compromises every attestation built on top of it.

Start here: Expand any key in the UEFI hierarchy (PK, KEK, db) and press Analyze PQC Requirements: each key gets a risk level, finding and PQC action, plus the db storage impact of ML-DSA-65 certificates.

For your role

Security Architect
Analyse the UEFI PK, KEK and db hierarchy, explore TPM 2.0 key hierarchies with the hybrid RSA TPM plus ML-DSA approach, and design attestation flows for Measured Boot, TPM Quote and DICE.
Researcher / Academic
The vendor readiness comparison across AMI, Insyde, EDK2 and Dell and the live TPM 2.0 V1.85 key generation in the sandbox are the current state of firmware PQC; the TPM playground runs the commands.
Certification & Validation Engineer
The UEFI PK, KEK and db hierarchy and the Measured Boot, TPM Quote and DICE attestation flows show where a PQC signature verifier sits in firmware; the vendor readiness comparison shows who ships one today.
IT Ops / DevOps
Walk the four-step ML-DSA-65 firmware signing migration from inventory onward: it is the rollout across the fleet, and the vendor comparison says which firmware can take it.
Practice in the Simulation

Secure Boot establishes a cryptographic chain of trust from hardware power-on through the OS kernel. Each stage must be verified by a trusted key before it executes. The hierarchy is: Platform Key (PK) → Key Exchange Key (KEK) → Authorized Signature Database (db) → Bootloader/Kernel signatures.

All UEFI Signing Keys Are Quantum-Vulnerable

Every RSA-2048 and ECDSA key in the UEFI Secure Boot hierarchy can be broken by a Cryptographically Relevant Quantum Computer (CRQC) via Shor's algorithm. An attacker who harvests signed firmware images today can forge signatures once a CRQC is available — enabling undetectable firmware rootkits.

UEFI Key Hierarchy Summary
KeyOwnerCurrentPQC TargetPriority
PKOEM / Platform ManufacturerRSA-2048 or RSA-4096ML-DSA-65 (FIPS 204)critical
KEKOS Vendor / OEMRSA-2048ML-DSA-65 (FIPS 204)critical
dbOS Vendor / Software PublisherRSA-2048 certificatesML-DSA-65 X.509 certificateshigh
dbxUEFI Forum / OEM / OS VendorSHA-256 hashesSHA-256 hashes (unchanged for revocation)low
MOKMachine Owner / AdminRSA-2048 or RSA-4096ML-DSA-65 (when shim supports FIPS 204)medium

The db size impact is a key operational concern: ML-DSA-65 X.509 certificates are approximately 6 KB vs 1.2 KB for RSA-2048. UEFI NVRAM typically allocates 32–64 KB for Secure Boot variables. A full PQC db migration may require platform NVRAM reallocation — verify UEFI NVRAM capacity before planning.

Boot Chain: Signing Surfaces
1
UEFI FirmwareRSA-2048 with SHA-256

Roadmap 2026–2027 (Intel Boot Guard, AMI, Insyde)

2
UEFI Secure Boot ValidationRSA-2048 or RSA-4096 EFI signature list

Requires PK/KEK/db migration to ML-DSA-65 and UEFI spec update

3
Bootloader (GRUB2 / systemd-boot / shim)RSA-2048 (shim) + ECDSA P-384 (GRUB2 signing)

GRUB2 PQC support planned; shim PQC requires Microsoft KEK migration

4
OS KernelRSA-4096 (Linux kernel signing)

Linux kernel PQC signing experimental (6.9+), production 2027+

5
Kernel Modules & DriversRSA-2048 or RSA-4096

Dependent on kernel signing migration; follows OS kernel timeline

Related Resources

HSM & PQC Operations
PKCS#11 v3.2 mechanisms and firmware migration
KMS & PQC Key Management
Envelope encryption and key hierarchy patterns
Confidential Computing
TEEs, remote attestation, and PQC
Crypto Agility
Algorithm-agnostic cryptographic infrastructure
OS Cryptographic Stacks
OS-level crypto providers, SSH host keys, and system TLS policy

Products shown here are a representative selection — not an exhaustive list. For the full vendor landscape with PQC readiness status, visit the Tools & Products tab in this module or browse the Migrate catalog →

Analyze UEFI key hierarchies, migrate firmware signatures, and explore TPM attestation flows.

Check off all sections and mark this reading done.

Related modules

In the Industry Landscape

Check your understanding

15 questions on Secure Boot & Firmware PQC, each with its answer and the reason.

Take the quiz

Next step

Practice it: Firmware Signing

Firmware Signing is the hands-on version of this module: the same ideas, run in your browser.

Learning module content can be inaccurate. Please double-check its information. Report inaccuracies in PQC Today GitHub Discussions.