Windows 8 requires secure boot on ARM hardware

Windows 8’s secure boot option cannot be disabled or modified if the operating system is installed on ARM hardware. This makes it impossible to run other operating systems.

In September, there was a commotion about Windows 8’s ‘secure boot’ option, which shuts down Windows’ boot process from start to finish, so that malicious code cannot start during the boot process. To this end, the secure boot option in the unified extensible firmware interface, the successor to the outdated bios, is used.

The fear was that other operating systems would no longer be able to boot thanks to the option. The uefi only accepts software with a valid signature and could therefore exclude other operating systems without signature. However, Microsoft put the fuss into perspective; hardware manufacturers would be given the option to allow users to disable secure boot.

That turns out to be only partly true. A recently released document detailing requirements that hardware manufacturers must meet to certify their devices for Windows 8 states that disabling secure boot is prohibited on ARM systems. Open source journalist Glyn Moody tumbled the document. So if manufacturers want to release ARM hardware with Windows 8, they must leave the secure boot option enabled. Also adjusting secure boot to load other operating systems is not possible.

In contrast, offering secure boot on non-ARM hardware is not mandatory. The Software Freedom Law Center stilt that this is because Microsoft has a very large market share in the PC market. The software giant could face problems with competition authorities if it is prevented from running other operating systems on x86 hardware. In the mobile device market, however, Microsoft does not have that market share and can make it impossible to run other operating systems.

Incidentally, as far as Microsoft is concerned, it is not allowed to automatically disable the secure boot option on x86 hardware. So other operating systems cannot disable the option during installation; a user will have to manually disable the secure boot in the setup screen of the uefi chip.